CVE-2025-60914

Executive Summary

CVE-2025-60914 is an improper access control vulnerability in the Austrian Archaeological Institute's Openatlas application, affecting versions prior to 8.12.0. An attacker can exploit this flaw by sending a crafted GET request to the /display_logo endpoint, leading to unauthorized access to sensitive information. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is real due to the potential exposure of internal data. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and requires no authentication.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder/unassigned)
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): None
• Availability (A): None
• Threat Level: Medium (due to ease of exploitation and potential data exposure)

Deep Dive & Mechanics

The vulnerability resides in the /display_logo endpoint of Openatlas. The application fails to enforce proper access control checks, allowing any unauthenticated user to retrieve sensitive files or data by manipulating the GET request parameters. The endpoint likely serves logo images but does not validate whether the requester has permission to access the requested resource. By crafting a request with path traversal or direct object reference, an attacker can read arbitrary files from the server, such as configuration files, database credentials, or other sensitive data.

The root cause is a missing authorization check in the controller handling the /display_logo route. The application trusts the user-supplied input without verifying if the requested resource is publicly accessible.

Vulnerable vs. Patched Code

Vulnerable Code (before v8.12.0):

@app.route('/display_logo')
def display_logo():
    logo_path = request.args.get('path')
    # No access control check
    return send_file(logo_path)

Patched Code (v8.12.0+):

@app.route('/display_logo')
@login_required
def display_logo():
    logo_path = request.args.get('path')
    if not is_allowed_path(logo_path):
        abort(403)
    return send_file(logo_path)

The patch adds authentication (@login_required) and a path validation function (is_allowed_path) to prevent unauthorized access and path traversal.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify Openatlas instances using Shodan dorks: http.title:"Openatlas" or http.html:"openatlas".
2. Craft Exploit: Send a crafted GET request to the /display_logo endpoint with a path traversal payload:

   GET /display_logo?path=../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Extract Data: If successful, the server returns the contents of /etc/passwd or other sensitive files.

Lab Setup:

• Deploy a vulnerable Openatlas instance (version < 8.12.0) using Docker:

  docker run -d -p 80:5000 openatlas:v8.10.0
  

• Test the exploit with curl:

  curl "http://localhost/display_logo?path=../../etc/passwd"
  

Blue Team

1. Monitor Logs: Look for GET requests to /display_logo with suspicious path parameters containing ../ or absolute paths.
2. Deploy WAF Rules: Block requests to /display_logo with path traversal patterns.
3. Harden Endpoint: Ensure the endpoint requires authentication and validates file paths against a whitelist.

Indicators of Compromise (IOCs)

• Network: GET requests to /display_logo with path parameter containing ../ or /etc/.
• Logs: Unauthorized access attempts to /display_logo from unknown IPs.
• File System: Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.

Detection Engineering

YARA Rule

rule CVE_2025_60914_Openatlas_Logo_PathTraversal {
    meta:
        description = "Detects path traversal attempts against Openatlas /display_logo endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60914"
    strings:
        $s1 = "/display_logo" ascii nocase
        $s2 = "path=" ascii nocase
        $s3 = "../" ascii
        $s4 = "..\\" ascii
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Openatlas /display_logo Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Openatlas /display_logo endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "/display_logo?path="
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in logo retrieval (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60914 Openatlas /display_logo Path Traversal"; flow:to_server,established; content:"/display_logo"; http_uri; content:"path="; http_uri; pcre:"/\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Openatlas version 8.12.0 or later.
2. Workaround: If upgrade is not possible, restrict access to /display_logo via web server configuration (e.g., Apache .htaccess or Nginx location block) to only authenticated users.
3. Long-term: Implement proper access control checks on all endpoints and validate user-supplied file paths against a whitelist.

Valters IT
Securing Digital Frontiers