CVE-2025-65879

Executive Summary

CVE-2025-65879 is an authenticated arbitrary file deletion vulnerability in Warehouse Management System version 1.2. The flaw resides in the /goods/deleteGoods endpoint, where a user-supplied goodsimg parameter is concatenated directly with the server's UPLOAD_PATH and passed to Java's File.delete() without any path traversal validation. An authenticated attacker can leverage this to delete arbitrary files on the underlying operating system, including web application source code, configuration files containing credentials, scheduled tasks, or system binaries. While the vulnerability requires prior authentication, its impact is severe — it can lead to full application denial-of-service, credential disclosure, and potentially remote code execution if critical system files are removed. No CVSS score is currently assigned, and no public exploit code has been confirmed, but the attack vector is straightforward and highly likely to be weaponized.

Technical Analysis

The vulnerability is a classic path traversal flaw in an authenticated file deletion context. The affected endpoint, /goods/deleteGoods, handles the deletion of goods records and their associated images. The application retrieves a goodsimg parameter from the HTTP request — typically containing a filename like product123.jpg — and constructs a full server-side file path by concatenating this value with a hardcoded UPLOAD_PATH directory.

The vulnerable code path follows a pattern similar to:

String imgName = request.getParameter("goodsimg");
File imgFile = new File(UPLOAD_PATH + imgName);
if (imgFile.exists()) {
    imgFile.delete();
}

Because the goodsimg parameter is not sanitized, an attacker can supply a value containing directory traversal sequences such as ../../../../etc/passwd or absolute paths. The concatenation UPLOAD_PATH + "../../../some/path" resolves to a location outside the intended upload directory, and the File.delete() operation removes it without any verification.

The attack surface is limited to authenticated users — the application requires a valid session before the endpoint can be invoked. However, warehouse management systems often have default credentials, weak password policies, or shared accounts among staff, making authentication a relatively low barrier. The vulnerability is exploitable via both GET and POST requests, as Java servlet frameworks commonly expose parameters through both methods.

The File.delete() call in Java returns a boolean (true on success, false on failure) but does not throw exceptions when deletion fails — this means an attacker may not immediately know if a deletion succeeded. However, by targeting predictable files (e.g., web application WAR files, Tomcat configuration, or /etc/cron.d entries) and then verifying through application behavior, an attacker can confirm successful exploitation. The vulnerability is single-shot per request, but it can be chained in loops to delete multiple files.

No default /install/ directory, debug console, or unauthenticated vector has been reported for this CVE. The core issue is purely the lack of input validation on the goodsimg parameter in the deletion routine.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification
An attacker first identifies a target instance of the Warehouse Management System. Since the application is likely a Java-based web app, it may be found via Shodan using the dorks listed above, or through application fingerprinting by browsing to the login page. The attacker confirms version 1.2 via the login page footer, a /version.jsp endpoint, or error messages revealing build information.

Step 2 — Authentication
The attacker gains valid credentials. This could be achieved via:

• Default credentials (commonly admin/admin, admin/123456, or similar in off-the-shelf WMS products).
• Credential stuffing using previously leaked credentials from other breaches.
• Password spraying against the login form.
• If the application has a registration endpoint for warehouse staff, the attacker may simply create an account.

Step 3 — Endpoint Discovery and Parameter Enumeration
After authentication, the attacker navigates to the goods management section. By inspecting the web traffic (via Burp Suite or browser developer tools), they identify the deleteGoods endpoint. A typical request looks like:

POST /goods/deleteGoods HTTP/1.1
Host: target-wms.local
Cookie: JSESSIONID=...

id=123&goodsimg=product123.jpg

Step 4 — Path Traversal Payload Weaponization
The attacker modifies the goodsimg parameter to traverse outside the upload directory. Example payloads:

• Delete a web application configuration file: goodsimg=../../../../../../etc/tomcat9/server.xml
• Delete the deployed WAR file to force a shutdown: goodsimg=../../../../webapps/wms.war
• Delete a cron job: goodsimg=../../../../../../etc/cron.d/backup
• Delete a file containing credentials: goodsimg=../../../../var/lib/mysql/.my.cnf

The exact traversal depth depends on the UPLOAD_PATH (e.g., webapps/wms/uploads/ requires three ../ segments to reach the web root, then additional ../ to reach the filesystem root).

Step 5 — Execution and Verification
The attacker sends the crafted request:

POST /goods/deleteGoods HTTP/1.1
Host: target-wms.local
Content-Type: application/x-www-form-urlencoded

id=123&goodsimg=../../../conf/server.xml

The server blindly calls File.delete() on the resolved path. If the web application itself is deleted (e.g., the WAR file), the application becomes unavailable — a clear sign of success. If a configuration file is deleted, the attacker may trigger a restart to observe failure, or simply wait for scheduled maintenance.

Step 6 — Post-Exploitation
With the ability to delete arbitrary files, the attacker can:

• Denial of Service: Delete the application's JAR/WAR files, killing the service.
• Credential Theft via Log Rotation: Delete log files to cover tracks, then later delete configuration files that cause the application to regenerate with default credentials, which the attacker then uses.
• Privilege Escalation: If the application runs as root (common in misconfigured deployments), the attacker deletes /etc/sudoers or creates symlink-based attack chains to gain shell access.
• Ransomware-Like Impact: Mass-delete database files or backups, rendering the business non-operational.

Limitations: The attacker cannot write files — only delete them. This limits direct RCE, but file deletion of application source code can force the server into an error state that, combined with other flaws (e.g., file upload functionality in the same application), may lead to code execution via file replacement.

Impact Assessment

Business Impact: The vulnerability enables a remote authenticated attacker to delete any file the web application's service account can access. In a typical Linux deployment running Tomcat as tomcat user, this includes the entire web application directory (/var/lib/tomcat9/webapps/), configuration files under /etc/tomcat9/, logs, and potentially database files if the database runs on the same host with permissive permissions. Deleting the application WAR results in full system unavailability, halting warehouse operations including inventory tracking, order fulfillment, and shipping. Downtime of a warehouse management system can cost thousands of dollars per hour in lost productivity.

Affected Systems: All deployed instances of Warehouse Management System version 1.2. The vendor identity is unknown; the software may be distributed as a commercial off-the-shelf product or a bespoke internal system that has been subsequently sold. This lack of clarity complicates asset inventory and patch management for affected organizations.

Blast Radius: If the application runs with elevated privileges (e.g., root), the attacker can delete system-critical files including /etc/passwd, /etc/shadow (locking out all users), or kernel modules, rendering the entire operating system inoperable. In a shared hosting environment, this could affect co-tenant applications. Even with standard low-privilege service accounts, the blast radius includes all web application artifacts and configuration, enabling data loss and prolonged recovery times.

CVSS Subscores: No CVSS vector is assigned. Based on the characteristics (authenticated, high impact, trivial complexity), a reasonable estimate would be 6.5–8.5, but the official score remains N/A. Security teams should treat this as a high-severity finding regardless.

Regulatory Considerations: Enterprises subject to PCI-DSS, SOC 2, or SOX may face compliance failures if customer or financial data resides on the affected host and is compromised via this deletion vector.

Detection Guidance

Sigma Rule

title: CVE-2025-65879 - WMS Arbitrary File Deletion via goodsimg Parameter
id: 8f3cde81-5a2b-4c6d-9e0f-7a51b2c3d4e5
status: experimental
description: Detects path traversal attempts in the goodsimg parameter of the Warehouse Management System deleteGoods endpoint
author: Valtersit Threat Intelligence
date: 2025/01/15
logsource:
  category: webserver
  product: tomcat
  definition: 'Requires access logs from the Tomcat server hosting the WMS application'
detection:
  selection:
    cs-uri-query|contains:
      - '/goods/deleteGoods'
    cs-uri-query|contains|all:
      - 'goodsimg='
      - '..%2f'
      - '..\\'
      - '/../'
  selection_plain:
    cs-uri-query|contains|all:
      - '/goods/deleteGoods'
      - 'goodsimg='
    cs-uri-query|re:
      - 'goodsimg=.*\.\./.*'
  condition: selection or selection_plain
falsepositives:
  - Legitimate file names containing '..' (unlikely)
level: high
tags:
  - attack.t1083
  - attack.t1220
  - cve.2025.65879

YARA Rule

rule CVE_2025_65879_WMS_File_Deletion
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests targeting the deleteGoods endpoint with path traversal payloads"
        date = "2025-01-15"
        cve = "CVE-2025-65879"
        severity = "high"
    strings:
        $endpoint = "deleteGoods" ascii wide
        $param = "goodsimg=" ascii wide
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "%2e%2e/" ascii wide
        $traversal4 = "%2e%2e%2f" ascii wide
        $war_sensitive = ".war" ascii wide
        $shell_sensitive = ".sh" ascii wide
        $conf_sensitive = ".conf" ascii wide
        $system_paths = "/etc/" ascii wide
    condition:
        $endpoint and $param and
        (
            any of ($traversal*) or
            any of ($sensitive*) or
            $system_paths
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-65879 - WMS deleteGoods path traversal attempt";
    flow:established,to_server;
    http.uri;
    content:"/goods/deleteGoods";
    http.client_body;
    content:"goodsimg=";
    pcre:"/goodsimg=[^&]*(?:\.\.(?:/|\\|%2f|%5c))+/i";
    classtype:attempted-admin;
    reference:cve,2025-65879;
    sid:10000001;
    rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "web" and url.path == "/goods/deleteGoods"]
  [process where event.action == "file-delete" and process.name : ("java", "tomcat*")]
  | where url.query contains "goodsimg=" and (
        url.query like "*%2e%2e%2f*" or
        url.query like "*%2e%2e%5c*" or
        url.query like "*/../*" or
        url.query like "*..%5c*"
  )

Splunk SPL Query

index=web sourcetype=tomcat:access
| where uri_path LIKE "%/goods/deleteGoods%"
| regex uri_query="goodsimg=.*(\.\.(\/|\\|%2f|%5c)).*"
| rex field=uri_query "goodsimg=(?<payload>[^&]*)"
| eval threat_indicators = if(match(uri_query, "(/etc/|\.war|\.conf|\.sh)"), "HIGH", "MEDIUM")
| stats count by src_ip, uri_path, payload, status, threat_indicators
| sort - _time
| where threat_indicators = "HIGH" OR payload LIKE "%..%"
| table _time, src_ip, uri_path, payload, status

Wazuh OSSEC Rule

<rule id="100123" level="12">
    <decoded>apache-accesslog</decoded>
    <field name="url">/goods/deleteGoods</field>
    <regex>goodsimg=.*(\.\.(/|\\|%2f|%5c)).*</regex>
    <description>CVE-2025-65879 - Warehouse Management System arbitrary file deletion attempt detected</description>
    <group>web_attack,path_traversal,cve_2025_65879,</group>
    <mitre>
        <id>T1083</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch exists, not independently confirmed). There is no vendor advisory, no CVE reference to a patch commit, and no official patched version number published at the time of this writing. Organizations must NOT assume a patch is available; instead, they should apply the following mitigations immediately.

1. Immediate Mitigations (implement today):

• Input validation: Deploy a WAF (Web Application Firewall) rule that blocks any request to /goods/deleteGoods where the goodsimg parameter contains ../, ..\, %2e%2e%2f, or absolute path patterns (/etc/, /var/, C:\).
• Access restriction: Restrict network access to the application's admin/goods management functions using IP-based allowlisting at the reverse proxy or firewall level. Only allow requests from warehouse internal subnets.
• Authentication hardening: Enforce multi-factor authentication (MFA) for all users with access to the deleteGoods functionality. Since the vulnerability is authenticated, reducing the pool of possible attackers is a critical first step.
• File system permissions: Ensure the web application runs with the lowest possible privileges. The service account should have read-only access to the web application directory and NO write/delete access to system directories (/etc, /usr, /var/lib). This limits the blast radius of file deletion.

2. Patch/Upgrade Steps:

• Contact the software vendor or distributor for a patched version. If the vendor is unknown, check the application's login page footer or README/LICENSE files for product branding that can help identify the vendor.
• If a patched version is located, upgrade following the vendor's upgrade guide. Before upgrading, take a full backup of the application, database, and configuration files.
• If no patch is available: The only safe option is to disable the deleteGoods functionality entirely. This may be done by removing the endpoint from the servlet mapping in web.xml, or by blocklisting the URL at the web server level with a 403 response. Manual deletion of goods records must then be handled database-side by administrators.

3. Long-Term Hardening:

• Code review: If the source code is available, fix the vulnerability by validating the goodsimg parameter against a whitelist of acceptable file names (e.g., ^[a-zA-Z0-9_-]+\.(jpg|jpeg|png|gif)$), and use Paths.get(UPLOAD_PATH, imgName).normalize() to resolve paths, then check that the resolved path starts with the canonical upload directory.
• Runtime Protection: Deploy a RASP (Runtime Application Self-Protection) agent that intercepts File.delete() calls and blocks those targeting paths outside the designated upload directory.
• Monitoring: Implement file integrity monitoring (FIM) on critical system and application files, alerting on unexpected deletions.
• Asset Discovery: Identify all instances of this software across the enterprise. Since the vendor is unknown, conduct a network-wide search for applications with a "deleteGoods" endpoint or the specific WMS login page fingerprint to ensure no unmanaged instances remain.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-65879
2. MITRE ATT&CK Technique T1083: https://attack.mitre.org/techniques/T1083/
3. OWASP Path Traversal Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
4. FIRST.org EPSS (pending score): https://www.first.org/epss/

Exploit-in-the-Wild Evidence: None reported as of this writing. No threat actor campaigns, ransomware group activity, or weaponized exploits have been publicly attributed to CVE-2025-65879. However, given the simplicity of the vulnerability class and the extent of the impact (arbitrary file deletion), it is highly likely that exploit attempts will surface in the coming weeks. Security teams should treat the vulnerability as actively exploitable and prioritize patching or mitigation accordingly.