CVE-2025-69107

Executive Summary

CVE-2025-69107 is a critical Unauthenticated Local File Inclusion (LFI) vulnerability affecting Rosaleen versions up to and including 2.8. This vulnerability allows an unauthenticated attacker to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and application source code. The vulnerability has a CVSS score of 8.1 (High) and is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). No official patch is currently available from the vendor, making this a high-priority security risk for all deployments running the affected versions.

Supply Chain & Package Security

Rosaleen is a PHP-based application. The vulnerability exists in the core file inclusion mechanism, which does not properly sanitize user-supplied input before passing it to PHP's include() or require() functions. This is a classic LFI pattern that can be exploited without authentication. The lack of a vendor patch means that organizations must rely on virtual patching via Web Application Firewalls (WAF) or manual code fixes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of network exploitability, low complexity, and no authentication makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the way Rosaleen handles file inclusion for templates or modules. The application likely uses a parameter (e.g., page, file, template) to dynamically include PHP files. The input is not sanitized or validated, allowing path traversal sequences (e.g., ../../../etc/passwd) to be injected.

Root Cause: The application uses user-supplied input directly in a PHP include() or require() statement without proper filtering. For example:

include($_GET['page'] . '.php');

An attacker can bypass the .php extension by using a null byte injection (in older PHP versions) or by using PHP wrappers like php://filter to read arbitrary files.

Exploitation Scenario:

1. Attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The request includes a path traversal payload in the vulnerable parameter.
3. The server includes the specified file, outputting its contents in the response.

Example Payload:

http://target.com/index.php?page=../../../etc/passwd%00

Or using PHP wrappers:

http://target.com/index.php?page=php://filter/convert.base64-encode/resource=config

Vulnerable vs. Patched Code

Vulnerable Code (Rosaleen <= 2.8):

<?php
$page = $_GET['page'];
include($page . '.php');
?>

Patched Code (Recommended):

<?php
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Handle error
    echo "Invalid page.";
}
?>

The patched version uses a whitelist approach, ensuring only predefined pages can be included. Additionally, input validation and sanitization should be applied to prevent path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Rosaleen 2.8 on a local server (e.g., XAMPP, LAMP).
2. Ensure the vulnerable parameter is exposed (e.g., index.php?page=).

Exploitation Steps:

1. Identify the vulnerable parameter by fuzzing common parameters like page, file, template.
2. Test for LFI using path traversal:

   http://target.com/index.php?page=../../../etc/passwd
   

3. If the .php extension is appended, use a null byte (if PHP < 5.3.4) or PHP wrappers:

   http://target.com/index.php?page=php://filter/convert.base64-encode/resource=config
   

4. Decode the base64 output to retrieve the file contents.

Automated Exploitation: Use tools like curl or Burp Suite to automate the process.

curl -s "http://target.com/index.php?page=php://filter/convert.base64-encode/resource=config" | base64 -d

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, ..\\, php://).
• Look for requests to index.php with unusual page parameters.
• Alert on base64-encoded responses from unexpected endpoints.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block path traversal and PHP wrapper usage.
• Apply virtual patching by modifying the application code to use a whitelist.
• Restrict file permissions on the server to limit the impact of file disclosure.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..\\ in the query string.
  • Requests with php://filter or php://input in the URL.
  • Unusual base64-encoded responses from the application.

• File IOCs:

  • Access to /etc/passwd, /etc/shadow, or application configuration files.
  • Log entries showing failed attempts to include non-existent files.

• Log IOCs:

  • Web server logs showing repeated path traversal attempts.
  • Error logs with "include(): Failed opening" messages.

Detection Engineering

YARA Rule

rule CVE_2025_69107_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting CVE-2025-69107 in Rosaleen"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $php_wrapper = /php:\/\/(filter|input|stdin)/
        $null_byte = /%00/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-69107 - Rosaleen LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal and PHP wrapper usage in HTTP requests targeting Rosaleen
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '..'
            - 'php://'
            - '%00'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69107 - Rosaleen LFI Attempt"; flow:to_server,established; content:".."; http_uri; nocase; content:"php://"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy WAF rules to block path traversal and PHP wrapper usage.
2. Code Fix: Modify the vulnerable code to use a whitelist of allowed files.
3. Input Validation: Implement strict input validation and sanitization for all user-supplied parameters.

Long-Term Actions:

1. Upgrade: Monitor for an official patch from Rosaleen and apply it immediately.
2. Security Audit: Conduct a full security audit of the application to identify similar vulnerabilities.
3. Least Privilege: Ensure the web server runs with minimal file system permissions to limit the impact of file disclosure.

Workaround: If patching is not possible, disable the vulnerable functionality or restrict access to the vulnerable endpoint via .htaccess or server configuration.

Valters IT