CVE-2025-69342

Executive Summary

CVE-2025-69342 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Calafate application by VanKarWai, up to and including version 1.7.7. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files, source code, or system files like /etc/passwd. The CVSS score is 7.5 (High), and no public exploit or patch is currently available. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is high due to the ease of exploitation and the potential for significant data leakage. An attacker can read sensitive files without authentication, which may lead to further compromise.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) in the Calafate application. The application uses a user-supplied parameter to construct a file path for an include/require statement without proper sanitization. For example, a vulnerable code snippet might look like:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can manipulate the file parameter to traverse directories and include arbitrary files. For instance, using ../../../../etc/passwd%00 (null byte injection) or php://filter/convert.base64-encode/resource=config to read source code. The lack of input validation allows reading any file on the server that the web server user has access to.

Vulnerable vs. Patched Code

Vulnerable Code (Calafate <= 1.7.7):

<?php
// Vulnerable: Direct use of user input in include
$page = $_GET['page'];
include("pages/" . $page . ".php");
?>

Patched Code (Hypothetical):

<?php
// Patched: Whitelist allowed files
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include("pages/" . $page . ".php");
} else {
    // Default page
    include("pages/home.php");
}
?>

The patched version uses a whitelist to restrict included files to a predefined set, preventing directory traversal and arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Calafate version 1.7.7 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://localhost/calafate.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., page, file, template).
2. Test for LFI using path traversal:

   http://localhost/calafate/index.php?page=../../../../etc/passwd
   

3. If null byte injection works (PHP < 5.3.4):

   http://localhost/calafate/index.php?page=../../../../etc/passwd%00
   

4. Use PHP wrappers to read source code:

   http://localhost/calafate/index.php?page=php://filter/convert.base64-encode/resource=index
   

5. Decode the base64 output to view the source.

Expected Output: Contents of /etc/passwd or base64-encoded source code.

Blue Team

Detection:

• Monitor web server logs for suspicious patterns like ../, %00, or php://.
• Look for requests with multiple directory traversal sequences.
• Alert on attempts to read sensitive files (e.g., /etc/passwd, /etc/shadow).

Mitigation:

• Apply input validation and whitelisting.
• Disable allow_url_include in php.ini.
• Use a Web Application Firewall (WAF) to block LFI patterns.

Indicators of Compromise (IOCs)

• URL Patterns:
  • ?page=../../../../etc/passwd
  • ?page=php://filter/convert.base64-encode/resource=
  • ?file=....//....//....//etc/passwd
• Log Entries:
  • GET /calafate/index.php?page=../../../../etc/passwd HTTP/1.1
  • GET /calafate/index.php?page=php://filter/... HTTP/1.1
• File Access: Unauthorized reads of /etc/passwd, application source files, or configuration files.

Detection Engineering

YARA Rule

rule CVE_2025_69342_LFI_Calafate {
    meta:
        description = "Detects LFI attempts targeting Calafate CVE-2025-69342"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69342"
    strings:
        $lfi1 = "page=../" ascii nocase
        $lfi2 = "file=../" ascii nocase
        $lfi3 = "php://filter" ascii nocase
        $lfi4 = "/etc/passwd" ascii nocase
    condition:
        any of ($lfi*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-69342 Calafate LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Calafate
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'page=../'
            - 'file=../'
            - 'php://filter'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69342 Calafate LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"page=../"; http_uri; nocase; content:"/etc/passwd"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable functionality if possible.
   • Apply input validation: whitelist allowed files.
   • Set allow_url_include = Off in php.ini.
   • Use a WAF to block LFI patterns.

2. Long-term Fix:

   • Upgrade to a patched version when available.
   • Implement proper file inclusion logic with whitelisting.
   • Conduct a security audit of the codebase.

3. Monitoring:

   • Enable detailed logging for web requests.
   • Set up alerts for LFI patterns.
   • Regularly review logs for suspicious activity.

Valters IT
Securing Digital Frontiers