CVE-2025-61686

Executive Summary

CVE-2025-61686 is a critical path traversal vulnerability (CWE-22) affecting the session file storage mechanism in React Router (v7) and Remix (v2) frameworks. When createFileSessionStorage() is used with an unsigned cookie, an attacker can manipulate the session cookie to force the server to read or write session files outside the intended directory. This can lead to unauthorized access to sensitive server-side data or arbitrary file writes, depending on web server permissions. The vulnerability has a CVSS score of 9.1 (Critical) and is currently unpatched in older versions. Patches are available for the affected packages.

Supply Chain & Package Security

This vulnerability resides in the npm packages @react-router/node, @remix-run/node, and @remix-run/deno. Organizations using these packages in their Node.js or Deno applications are at risk. The attack vector is through the session cookie, which is a standard HTTP mechanism, making this a supply-chain risk for any application using the vulnerable versions. Developers must update to the patched versions immediately to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Potential for reading sensitive session files.
• Integrity (I): High (H) – Potential for writing arbitrary files.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Critical. The low attack complexity and lack of required privileges make this vulnerability highly exploitable. The potential for both reading and writing files outside the intended directory poses a severe risk to data confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability lies in the createFileSessionStorage() function, which is used to store session data in files on the server's filesystem. The function uses a cookie to identify the session file. When the cookie is unsigned (i.e., not cryptographically signed), an attacker can forge the cookie value to include path traversal sequences (e.g., ../).

The vulnerable code likely constructs the file path by concatenating a base directory with the session ID from the cookie without proper sanitization. For example:

const filePath = path.join(sessionDir, sessionId);

If sessionId is ../../etc/passwd, the resulting path would be outside the intended sessionDir. The server would then attempt to read or write to that path.

Key Conditions for Exploitation:

1. The application uses createFileSessionStorage() with an unsigned cookie.
2. The web server process has read/write permissions to the target file.
3. For reading, the file must match the expected session file format (e.g., JSON with specific structure). The data is not directly returned to the attacker but is loaded into the server-side session object. The attacker can then infer the data if the application logic returns session-specific information.
4. For writing, the attacker can create or overwrite files, potentially leading to code execution or data corruption.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// @react-router/node < 7.9.4
function createFileSessionStorage({ dir, cookie }) {
  return {
    async getSession(cookieHeader) {
      const sessionId = parseCookie(cookieHeader, cookie.name);
      // No validation of sessionId
      const filePath = path.join(dir, sessionId);
      // Read file at filePath
    },
    async commitSession(session) {
      const sessionId = generateId();
      // No validation of sessionId
      const filePath = path.join(dir, sessionId);
      // Write session to filePath
    }
  };
}

Patched Code (Conceptual):

// @react-router/node >= 7.9.4
function createFileSessionStorage({ dir, cookie }) {
  return {
    async getSession(cookieHeader) {
      const sessionId = parseCookie(cookieHeader, cookie.name);
      // Validate sessionId to prevent path traversal
      if (!isValidSessionId(sessionId)) {
        throw new Error('Invalid session ID');
      }
      const filePath = path.join(dir, sessionId);
      // Ensure filePath is within dir
      if (!filePath.startsWith(dir)) {
        throw new Error('Path traversal detected');
      }
      // Read file at filePath
    },
    async commitSession(session) {
      const sessionId = generateId();
      // Validate sessionId
      if (!isValidSessionId(sessionId)) {
        throw new Error('Invalid session ID');
      }
      const filePath = path.join(dir, sessionId);
      // Ensure filePath is within dir
      if (!filePath.startsWith(dir)) {
        throw new Error('Path traversal detected');
      }
      // Write session to filePath
    }
  };
}

The patch adds validation of the session ID to ensure it does not contain path traversal characters and verifies that the resolved file path is within the intended directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Deploy a vulnerable Remix v2 application using @remix-run/node@2.17.1 with createFileSessionStorage() and an unsigned cookie.
2. Ensure the web server process has read access to /etc/passwd (for demonstration) and write access to /tmp/.

Exploitation Steps:

1. Identify the cookie name: The application sets a cookie (e.g., session).
2. Forge the cookie: Set the cookie value to a path traversal string.
   • For reading: ../../etc/passwd
   • For writing: ../../tmp/evil
3. Send the request:

   curl -v -b "session=../../etc/passwd" http://target.com/some-endpoint
   

4. Observe the behavior: If the server reads the file and the format matches, the session data will be populated. The attacker may need to trigger an endpoint that returns session data to exfiltrate it.
5. For writing: Send a POST request with a crafted session payload.

   curl -v -X POST -b "session=../../tmp/evil" -d '{"data":"malicious"}' http://target.com/some-endpoint
   

Note: The success of reading depends on the file format. The attacker may need to guess or brute-force file paths.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for path traversal patterns in cookies: Look for ../ or ..\\ in cookie values.
2. Audit file access logs: Check for unexpected file reads/writes outside the session directory.
3. Review application logs: Look for errors related to file operations or session parsing.
4. Implement input validation: Ensure all session IDs are validated against a strict pattern (e.g., alphanumeric only).
5. Use signed cookies: Always sign cookies to prevent tampering.

Mitigation:

• Update to patched versions immediately.
• If patching is not possible, implement a reverse proxy or WAF rule to block path traversal patterns in cookies.
• Restrict web server permissions to the minimum required.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with cookie values containing ../ or ..\\ sequences.
  • Unusual file paths in server logs (e.g., /etc/passwd, /proc/self/environ).
• Host:
  • Unexpected files in the session storage directory.
  • Files outside the session directory with timestamps matching web server activity.
  • Web server process accessing files outside its intended scope (visible in audit logs).
• Application:
  • Session data containing unexpected values (e.g., contents of system files).
  • Errors related to file reading/writing in application logs.

Detection Engineering

YARA Rule

rule CVE_2025_61686_Path_Traversal {
  meta:
    description = "Detects path traversal attempts in cookie values targeting CVE-2025-61686"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-61686"
  strings:
    $path_traversal = /(\.\.\/|\.\.\\)/
    $cookie_header = /Cookie:\s*[^=]+=/
  condition:
    $cookie_header and $path_traversal
}

Sigma Rule

title: CVE-2025-61686 Path Traversal in Cookie
id: cve-2025-61686-cookie-traversal
status: experimental
description: Detects path traversal patterns in HTTP cookie values
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET' or 'POST'
    cs-cookie|contains: 
      - '../'
      - '..\\'
  condition: selection
falsepositives:
  - Legitimate use of special characters in cookie values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61686 Path Traversal in Cookie"; flow:to_server; content:"Cookie"; nocase; pcre:"/Cookie:\s*[^=]+=[^;]*\.\.\//i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update packages:
   • @react-router/node to version 7.9.4 or later.
   • @remix-run/node to version 2.17.2 or later.
   • @remix-run/deno to version 2.17.2 or later.
2. If immediate update is not possible:
   • Implement a Web Application Firewall (WAF) rule to block path traversal patterns in cookies.
   • Use signed cookies to prevent tampering.
   • Restrict web server file system permissions to the minimum required.

Long-term Measures:

• Conduct a security audit of all session handling code.
• Implement input validation and sanitization for all user-controlled data.
• Use secure defaults, such as signed cookies, in all applications.
• Regularly update dependencies and monitor for security advisories.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For further analysis or remediation support, contact your security team.