CVE-2025-62364

Executive Summary

CVE-2025-62364 is a Local File Inclusion (LFI) vulnerability in Oobabooga's text-generation-webui, an open-source web interface for running Large Language Models. The flaw resides in the character picture upload feature, where an attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. The vulnerability affects versions through 3.13 and is fixed in version 3.14. No known workarounds exist.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects a Python-based application. The risk is elevated due to the lack of a patch for older versions and the potential for supply chain attacks if the application is distributed via container images or package repositories.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the high confidentiality impact but no impact on integrity or availability. The vulnerability is easily exploitable by an unauthenticated attacker over the network.

Deep Dive & Mechanics

The vulnerability exists in the character picture upload feature of text-generation-webui. The application allows users to upload images for character profiles. The flaw is that the application does not properly validate the content of uploaded files. An attacker can create a text file that contains a symbolic link (symlink) pointing to an arbitrary file on the server (e.g., /etc/passwd, /etc/shadow, configuration files). When the application processes the upload, it follows the symlink and serves the contents of the targeted file through the web interface.

The attack flow:

1. Attacker creates a file (e.g., malicious.txt) containing a symlink to a sensitive file (e.g., /etc/passwd).
2. Attacker uploads this file via the character picture upload feature.
3. The application processes the upload, follows the symlink, and reads the contents of the targeted file.
4. The application serves the file contents to the attacker via the web interface.

This is a classic Local File Inclusion (LFI) vulnerability, categorized under CWE-73 (External Control of File Name or Path). The vulnerability is unauthenticated, meaning no login is required to exploit it.

Vulnerable vs. Patched Code

Vulnerable Code (versions through 3.13): The vulnerable code likely does not validate the uploaded file's content or check for symbolic links. It may use a function like os.path.join or shutil.copy without verifying the file type or resolving symlinks.

# Vulnerable example (pseudocode)
def upload_character_picture(file):
    # No validation of file content
    # No check for symlinks
    file_path = os.path.join(UPLOAD_DIR, file.filename)
    with open(file_path, 'wb') as f:
        f.write(file.read())
    # Later, when serving the file:
    return send_file(file_path)

Patched Code (version 3.14): The patched code likely validates the uploaded file to ensure it is an actual image (e.g., by checking MIME type or using a library like Pillow to verify the image). It may also resolve symlinks before processing.

# Patched example (pseudocode)
def upload_character_picture(file):
    # Validate file type
    if not allowed_file(file.filename):
        return "Invalid file type", 400
    # Check for symlinks
    file_path = os.path.join(UPLOAD_DIR, file.filename)
    if os.path.islink(file_path):
        return "Symlinks not allowed", 400
    # Process file
    with open(file_path, 'wb') as f:
        f.write(file.read())
    # Serve the file
    return send_file(file_path)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install text-generation-webui version 3.13 or earlier.
2. Ensure the application is running and accessible over the network.
3. Create a malicious file containing a symlink to a sensitive file (e.g., /etc/passwd).

Exploitation Steps:

1. Create a symlink file on the attacker's machine:

   ln -s /etc/passwd malicious.txt
   

2. Upload the file via the character picture upload feature (e.g., using curl):

   curl -X POST -F "file=@malicious.txt" http://target:port/upload_character_picture
   

3. Access the uploaded file via the web interface to retrieve the contents of /etc/passwd.

Expected Output: The attacker will receive the contents of the targeted file (e.g., /etc/passwd).

Blue Team

Detection:

• Monitor for unusual file uploads, especially files with extensions like .txt or .lnk being uploaded to image upload endpoints.
• Monitor for requests to the upload endpoint with unusual file sizes or content types.
• Monitor for subsequent requests to access uploaded files that contain sensitive data.

Mitigation:

• Immediately upgrade to version 3.14.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block uploads of files that are not images (e.g., block files with extensions other than .png, .jpg, .gif).
• Validate uploaded files by checking MIME type and using image processing libraries to verify the file is a valid image.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example, not actual)
  • malicious.txt: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /upload_character_picture with file content containing symlink data.
  • GET requests to /uploads/<filename> where the filename is unusual (e.g., .txt extension).
• Log Entries:
  • Application logs showing upload of non-image files.
  • System logs showing access to sensitive files (e.g., /etc/passwd) by the web application user.

Detection Engineering

YARA Rule

rule CVE_2025_62364_LFI_Symlink_Upload {
    meta:
        description = "Detects attempts to upload a symlink file for CVE-2025-62364"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62364"
    strings:
        $symlink_magic = { 2F 65 74 63 2F 70 61 73 73 77 64 } // "/etc/passwd" in ASCII
        $symlink_magic2 = { 2F 65 74 63 2F 73 68 61 64 6F 77 } // "/etc/shadow" in ASCII
        $symlink_magic3 = { 2F 68 6F 6D 65 2F } // "/home/" in ASCII
    condition:
        any of ($symlink_magic*) and filesize < 1KB
}

Sigma Rule

title: CVE-2025-62364 LFI via Symlink Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of files containing symlinks to sensitive files
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62364
logsource:
    category: webserver
    product: text-generation-webui
detection:
    selection:
        http.method: POST
        http.url: '/upload_character_picture'
        http.file_extension: 'txt'
    condition: selection
falsepositives:
    - Legitimate text file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62364 LFI via Symlink Upload"; flow:to_server,established; content:"POST"; http_method; content:"/upload_character_picture"; http_uri; content:".txt"; http_client_body; pcre:"/\\x2F(?:etc|home|var|root)\\x2F/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to text-generation-webui version 3.14 or later.
2. If upgrade is not possible, restrict access to the upload endpoint using a WAF or network firewall.
3. Implement file type validation on the server side to only allow image files (e.g., check MIME type and use image processing libraries).

Long-term Measures:

• Conduct a security audit of the application to identify similar vulnerabilities.
• Implement input validation and sanitization for all file uploads.
• Use a Content Security Policy (CSP) to mitigate the impact of LFI.
• Monitor logs for suspicious file uploads and access patterns.

Workarounds:

• No known workarounds exist for this vulnerability.

Valters IT
Securing Digital Frontiers