CVE-2025-58753

Executive Summary

CVE-2025-58753 is a missing permission check vulnerability in the Copyparty portable file server, affecting versions prior to 1.19.8. The flaw resides in the shares feature (shr global-option). When a share is created for a single file within a folder, an unauthenticated attacker can access sibling files in the same directory by guessing filenames. The vulnerability does not allow directory traversal into subdirectories, nor does it affect filekeys or dirkeys. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate (CVSS 5.3 based on vector). No public exploit code or PoC is available, and the vendor has released a fix in version 1.19.8.

Supply Chain & Package Security

Copyparty is a Python-based file server distributed via PyPI. Users should verify the integrity of the package after upgrading by checking checksums or using pip install --upgrade copyparty==1.19.8.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (sibling file access)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthorized read access to files in the same directory as a shared file, but does not enable traversal or modification.

Deep Dive & Mechanics

The vulnerability is rooted in the shr global-option of Copyparty, which allows administrators to create shares for specific files or directories. When a share is created for a single file (e.g., shr=/path/to/file.txt), the server should restrict access to only that file. However, due to a missing permission check, the server inadvertently allows access to other files in the same directory if the attacker knows or guesses their filenames.

Root Cause: The permission validation logic does not properly enforce the scope of a file-level share. When a request is made for a file in the same directory as the shared file, the server fails to verify that the requested file is the exact one specified in the share configuration.

Attack Scenario:

1. An administrator creates a share for document.pdf in /shared/.
2. An attacker accesses the share URL and guesses the name of another file, e.g., secret.txt.
3. The server serves secret.txt without proper authorization.

Limitations:

• Only sibling files (same directory) are accessible.
• Subdirectory traversal is not possible.
• Filekeys and dirkeys are unaffected.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.19.8):

# Simplified representation of the flawed permission check
def check_share_access(share_path, requested_path):
    # Missing check: only verifies if requested_path is within share_path
    if requested_path.startswith(share_path):
        return True
    return False

Patched Code (1.19.8):

# Corrected permission check
def check_share_access(share_path, requested_path):
    # Ensure the requested path exactly matches the share path for file shares
    if os.path.isfile(share_path):
        return requested_path == share_path
    # For directory shares, ensure requested_path is within share_path
    if requested_path.startswith(share_path):
        return True
    return False

The patch adds an exact match check for file-level shares, preventing access to sibling files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Copyparty instance (version < 1.19.8) with a file-level share configured.
• Knowledge of sibling filenames (can be guessed or enumerated).

Exploitation Steps:

1. Identify a share URL for a single file, e.g., http://target:port/shr/document.pdf.
2. Guess or enumerate filenames in the same directory (e.g., secret.txt, config.json).
3. Access http://target:port/shr/secret.txt to retrieve the file.

Example using curl:

curl http://target:port/shr/secret.txt

No public exploit code is available.

Blue Team (Detection & Defense)

Detection:

• Monitor access logs for requests to files in the same directory as a shared file.
• Look for patterns of sequential or brute-force filename guessing.

Defense:

• Upgrade to Copyparty 1.19.8 or later.
• Use directory-level shares with filekeys for sensitive files.
• Implement network segmentation to limit exposure of Copyparty instances.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /shr/ followed by filenames that are not the intended shared file.
• Logs: Access log entries showing 200 responses for files in the same directory as a shared file.
• File System: No direct file system IOCs; the vulnerability is purely access control.

Example Log Entry:

192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "GET /shr/secret.txt HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2025_58753_Copyparty_Share_Bypass {
    meta:
        description = "Detects Copyparty versions vulnerable to CVE-2025-58753"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-58753"
    strings:
        $version_string = "Copyparty/"
        $vuln_version = /Copyparty\/1\.(1[0-8]|19\.[0-7])/
    condition:
        $version_string and $vuln_version
}

Sigma Rule

title: CVE-2025-58753 - Copyparty Share Permission Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to sibling files via Copyparty share feature
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: copyparty
detection:
    selection:
        cs-uri-query|contains: '/shr/'
    condition: selection
falsepositives:
    - Legitimate access to multiple files in a directory share
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58753 - Copyparty Share Bypass Attempt"; flow:to_server; http.uri; content:"/shr/"; http.uri; content:"/"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Copyparty version 1.19.8 or later.
• If upgrade is not possible, restrict access to Copyparty instances via firewall or VPN.

Long-term:

• Review all share configurations and use directory-level shares with filekeys for sensitive files.
• Implement additional access controls (e.g., authentication) for file shares.
• Monitor for unusual access patterns.

Patch Details: Upgrade to version 1.19.8, which includes the fix for the missing permission check.

Valters IT
DevSecOps & Cyber Threat Intelligence