CVE-2025-68430

Executive Summary

CVE-2025-68430 is a directory listing vulnerability in CVAT (Computer Vision Annotation Tool), an open-source interactive video and image annotation tool for computer vision. An authenticated attacker can enumerate the contents of any file system directory accessible to the CVAT server, exposing file and subdirectory names. While file contents are not directly readable, the leaked directory structure can aid in reconnaissance for further attacks. The vulnerability affects versions 2.8.1 through 2.52.0 and is patched in version 2.53.0.

Supply Chain & Package Security

CVAT is distributed as a Python package via PyPI (cvat-sdk) and as a Docker image. Users should verify they are not running a vulnerable version by checking their installed package version with pip show cvat-sdk or inspecting the Docker image tag. The patch in version 2.53.0 addresses the directory listing flaw, and no known workarounds exist.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Network (assumed)
• Attack Complexity (AC): Low (assumed)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): Low (directory names only)
• Integrity (I): None
• Availability (A): None
• Threat Level: Medium (due to information disclosure aiding further attacks)

Deep Dive & Mechanics

The vulnerability resides in the CVAT server's file system access functionality. An authenticated attacker can craft a request to list directory contents without proper authorization checks. The server returns the names of files and subdirectories within the requested path, but not the file contents. This is a classic directory listing vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor).

The attack flow:

1. Attacker authenticates to the CVAT instance.
2. Attacker sends a specially crafted request to a vulnerable endpoint (e.g., /api/v1/tasks/{id}/data or similar) with a path traversal payload.
3. The server returns a JSON or HTML response containing the directory listing.
4. Attacker uses this information to map the server's file structure, potentially identifying configuration files, logs, or other sensitive paths.

Vulnerable vs. Patched Code

Vulnerable Code (versions 2.8.1 to 2.52.0):

# Example vulnerable endpoint
@app.route('/api/v1/tasks/<int:task_id>/data')
def get_task_data(task_id):
    path = request.args.get('path', '/')
    # No validation of path parameter
    if os.path.isdir(path):
        files = os.listdir(path)
        return jsonify({'files': files})
    else:
        return jsonify({'error': 'Not a directory'}), 400

Patched Code (version 2.53.0):

# Example patched endpoint
import os
from flask import request, jsonify, abort

ALLOWED_BASE = '/data/cvat'

@app.route('/api/v1/tasks/<int:task_id>/data')
def get_task_data(task_id):
    path = request.args.get('path', '/')
    # Validate path is within allowed base directory
    full_path = os.path.normpath(os.path.join(ALLOWED_BASE, path))
    if not full_path.startswith(ALLOWED_BASE):
        abort(403)
    if os.path.isdir(full_path):
        files = os.listdir(full_path)
        return jsonify({'files': files})
    else:
        return jsonify({'error': 'Not a directory'}), 400

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable CVAT instance (version 2.8.1 to 2.52.0) using Docker:

   docker run -d -p 8080:8080 cvat/cvat:2.8.1
   

2. Create a user account and obtain authentication token.

Exploitation Steps:

1. Authenticate and obtain a session cookie or API token.
2. Enumerate directories using path traversal:

   curl -X GET "http://target:8080/api/v1/tasks/1/data?path=../../etc" \
        -H "Authorization: Token <your_token>"
   

3. Expected response:

   {
     "files": ["passwd", "shadow", "hostname", ...]
   }
   

4. Continue enumeration to map the file system.

Blue Team

Detection:

• Monitor for requests with suspicious path parameters containing ../ or absolute paths.
• Alert on multiple directory listing requests to the same endpoint.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Upgrade to version 2.53.0 immediately.
• If upgrade is not possible, restrict access to the vulnerable endpoint via a reverse proxy (e.g., Nginx) with allow/deny rules.
• Implement Web Application Firewall (WAF) rules to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/tasks/*/data with path parameter containing ../ or /etc/, /var/, /proc/, etc.
  • Repeated 200 responses with JSON containing "files" key and array of strings.
• File System IOCs:
  • Unexpected directory listing logs in CVAT server logs.
  • Presence of reconnaissance tools like curl or wget in server logs.
• Log IOCs:
  • CVAT access logs showing multiple GET /api/v1/tasks/*/data requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2025_68430_CVAT_Directory_Listing {
    meta:
        description = "Detects CVAT directory listing exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68430"
    strings:
        $path_traversal = /path=\.\.\// nocase
        $sensitive_path = /path=\/(etc|var|proc|root|home|tmp|usr)\// nocase
        $json_response = /"files"\s*:\s*\[/ nocase
    condition:
        any of ($path_traversal, $sensitive_path) and $json_response
}

Sigma Rule

title: CVE-2025-68430 CVAT Directory Listing Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit directory listing vulnerability in CVAT
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68430
logsource:
    category: webserver
    product: cvat
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'path=../'
            - 'path=/etc/'
            - 'path=/var/'
            - 'path=/proc/'
    condition: selection
falsepositives:
    - Legitimate use of path parameter for valid data retrieval
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-68430 CVAT Directory Listing Exploitation Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/tasks/"; http_uri;
    content:"path="; http_uri;
    pcre:"/path=(\.\.\/|\/(etc|var|proc|root|home|tmp|usr)\/)/i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-68430;
)

Remediation & Mitigation

1. Immediate Action: Upgrade CVAT to version 2.53.0 or later.
2. Workaround: If upgrade is not possible, restrict access to the vulnerable endpoint using a reverse proxy (e.g., Nginx) with the following rule:

   location ~ ^/api/v1/tasks/.*/data {
       deny all;
       return 403;
   }
   

3. Long-term: Implement input validation and path sanitization for all file system operations. Use a whitelist of allowed directories.
4. Monitoring: Enable detailed logging for all API requests and monitor for suspicious path traversal patterns.
5. Network Segmentation: Ensure the CVAT server is not directly exposed to the internet; place it behind a VPN or bastion host.

Valters IT