CVE-2025-6375

Executive Summary

CVE-2025-6375 is a locally exploitable null pointer dereference vulnerability in the POCO C++ Libraries, specifically in the MultipartInputStream function within Net/src/MultipartReader.cpp. The vulnerability is rated as problematic with a CVSS score of 3.3 (Low). An attacker with local access can trigger a null pointer dereference, leading to a denial of service (DoS) condition. The exploit has been publicly disclosed, and a patch is available in version 1.14.2. This vulnerability does not affect web servers or network services directly but impacts applications using the POCO library for multipart parsing.

Supply Chain & Package Security

This vulnerability affects the POCO C++ Libraries, which are commonly used as a dependency in C++ applications. Organizations should verify if their software supply chain includes POCO versions prior to 1.14.2 and update accordingly. The library is available via package managers like vcpkg, Conan, and direct source downloads.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L) – Requires local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: Low (A:L) – Causes a denial of service (crash).

Threat Level: Low. The vulnerability requires local access and results only in a denial of service. It is not remotely exploitable.

Deep Dive & Mechanics

The vulnerability resides in the MultipartInputStream function of the MultipartReader.cpp file. The POCO library's multipart parser is used to handle MIME multipart data, commonly used in HTTP file uploads and email attachments. The issue occurs when the parser encounters a malformed or specially crafted multipart stream that causes a null pointer dereference.

Technical Details:

• The MultipartInputStream function processes incoming multipart data by reading headers and content.
• Under certain conditions, a pointer to a part's header or content buffer is not properly initialized or validated before use.
• When the parser attempts to access this uninitialized pointer, it dereferences a null address, causing the application to crash.
• The attack is triggered by providing a crafted multipart input to an application using the vulnerable POCO version.

Root Cause: Lack of null pointer validation in the multipart parsing logic. The code assumes that certain internal structures are always valid, but they can be null when the input is malformed.

Vulnerable vs. Patched Code

Vulnerable Code (POCO < 1.14.2):

// In MultipartReader.cpp
void MultipartInputStream::readNextPart() {
    // ... parsing logic ...
    if (part->header) {  // part->header may be null
        // process header
    }
    // part->stream may be null
    part->stream->read(buffer, size);  // null pointer dereference
}

Patched Code (POCO >= 1.14.2):

// In MultipartReader.cpp
void MultipartInputStream::readNextPart() {
    // ... parsing logic ...
    if (part->header) {
        // process header
    }
    if (part->stream) {  // Added null check
        part->stream->read(buffer, size);
    }
}

The patch adds a null pointer check before accessing the stream member, preventing the dereference.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running an application that uses POCO < 1.14.2.
• Ability to provide input to the multipart parser (e.g., via file upload, HTTP request, or local file).

Exploit Steps:

1. Craft a malformed multipart MIME message that triggers the null pointer dereference.
2. Deliver the crafted input to the target application (e.g., via a local file or network socket).
3. The application crashes, causing a denial of service.

Example Crafted Input:

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain

[malformed data that causes null pointer]
------WebKitFormBoundary--

Note: No public exploit code is available in Exploit-DB. The above is a conceptual example.

Blue Team (Detection & Prevention)

Detection:

• Monitor application logs for crashes related to MultipartReader or null pointer exceptions.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Prevention:

• Upgrade POCO to version 1.14.2 or later.
• Apply input validation on multipart data before processing.
• Use address sanitizers (ASan) during development to catch null pointer dereferences.

Indicators of Compromise (IOCs)

• Application Crashes: Frequent crashes in processes using POCO library, especially during multipart parsing.
• Log Entries: Error messages containing "null pointer", "Segmentation fault", or "MultipartInputStream".
• File Hashes: No specific file hashes; focus on POCO library version.
• Network Traffic: No specific network IOCs as the attack is local.

Detection Engineering

YARA Rule

rule CVE_2025_6375_POCO_Null_Pointer {
    meta:
        description = "Detects POCO library versions vulnerable to CVE-2025-6375"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6375"
    strings:
        $poco_version = "POCO C++ Libraries" nocase
        $vuln_func = "MultipartInputStream" nocase
        $vuln_file = "MultipartReader.cpp" nocase
    condition:
        $poco_version and $vuln_func and $vuln_file
}

Sigma Rule

title: CVE-2025-6375 - POCO Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes related to POCO multipart parsing
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: linux
detection:
    selection:
        EventID: 11  # Crash event
        Message|contains: 'MultipartInputStream'
    condition: selection
falsepositives:
    - Legitimate crashes from other causes
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-6375 - POCO Null Pointer Attempt"; content:"MultipartInputStream"; nocase; sid:1000001; rev:1;)

Note: Suricata rule is for network-based detection of exploit attempts, though the vulnerability is local.

Remediation & Mitigation

Immediate Actions:

1. Upgrade POCO to version 1.14.2 or later.
2. Apply the patch commit 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf if upgrading is not possible.

Long-term Mitigations:

• Implement input validation for all multipart data.
• Use static analysis tools to detect null pointer dereferences.
• Regularly update dependencies.

Workarounds:

• If upgrading is not feasible, disable multipart parsing functionality if not required.
• Use a web application firewall (WAF) to filter malformed multipart requests (though attack is local).

Valters IT
DevSecOps & Cyber Threat Intelligence