CVE-2025-9094

Executive Summary

CVE-2025-9094 is a Server-Side Template Injection (SSTI) vulnerability in ThingsBoard 4.1, specifically within the "Add Gateway Handler" component. The vulnerability allows an attacker to inject malicious template expressions into the gateway handler, leading to improper neutralization of special elements used in a template engine. This can be exploited remotely without authentication, potentially leading to information disclosure or remote code execution depending on the template engine capabilities. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation probability at this time. The vendor has acknowledged the issue and plans to release a fix in version 4.2.

Supply Chain & Package Security

This vulnerability affects the ThingsBoard IoT platform, which is a Java-based application. The core package is not distributed via NPM, PyPI, Go, or Ruby registries, but rather as a standalone Java application or Docker container. The vulnerability lies in the custom gateway handler code, not in a third-party package dependency.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack can be initiated remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service is possible.

Threat Level: Medium. The vulnerability is remotely exploitable without authentication, but the impact is limited to low confidentiality impact. The public availability of exploit details increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the "Add Gateway Handler" component of ThingsBoard 4.1. This handler processes requests to add new gateways to the platform. The flaw is a Server-Side Template Injection (SSTI) vulnerability, classified as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine.

The handler likely takes user-supplied input (e.g., gateway name, configuration parameters) and passes it directly into a template engine (such as FreeMarker, Thymeleaf, or similar) without proper sanitization. An attacker can craft a malicious payload that includes template expressions (e.g., ${7*7} for FreeMarker or {{7*7}} for Thymeleaf) which are then evaluated by the server.

For example, if the gateway name is used in a template like Welcome, ${gatewayName}!, an attacker could set the gateway name to ${7*7} and the server would render Welcome, 49!. This confirms the injection point. More advanced payloads could read system properties, execute commands, or access internal data.

The attack flow:

1. Attacker sends a crafted HTTP request to the ThingsBoard API endpoint responsible for adding gateways.
2. The request contains a malicious payload in a parameter that is passed to the template engine.
3. The template engine evaluates the payload, potentially executing arbitrary code or accessing sensitive data.
4. The result is returned to the attacker in the response.

Vulnerable vs. Patched Code

Vulnerable Code (ThingsBoard 4.1):

// Hypothetical vulnerable code
public String addGateway(String gatewayName) {
    String template = "Gateway " + gatewayName + " added successfully.";
    TemplateEngine engine = new TemplateEngine();
    return engine.process(template);
}

Patched Code (Expected in v4.2):

// Hypothetical patched code
public String addGateway(String gatewayName) {
    String sanitized = StringEscapeUtils.escapeHtml4(gatewayName);
    String template = "Gateway " + sanitized + " added successfully.";
    TemplateEngine engine = new TemplateEngine();
    return engine.process(template);
}

The patched code sanitizes the input before passing it to the template engine, preventing template injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy ThingsBoard 4.1 using Docker: docker run -d --name thingsboard -p 8080:8080 thingsboard/tb:4.1.0
2. Access the web interface at http://localhost:8080.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/gateway).
2. Craft a payload to test for SSTI. For FreeMarker (common in Java), use ${7*7}.
3. Send a POST request with the payload:

curl -X POST http://localhost:8080/api/gateway \
  -H "Content-Type: application/json" \
  -d '{"name": "${7*7}", "type": "MQTT"}'

4. If the response contains 49, the injection is successful.
5. Escalate to read system properties:

curl -X POST http://localhost:8080/api/gateway \
  -H "Content-Type: application/json" \
  -d '{"name": "${@java.lang.System@getProperties()}", "type": "MQTT"}'

Blue Team

Detection Steps:

1. Monitor for unusual HTTP requests to /api/gateway or similar endpoints.
2. Look for payloads containing template expressions like ${...}, {{...}}, or *{...}.
3. Check server logs for template evaluation errors or unexpected output.
4. Implement input validation and sanitization for all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/gateway with JSON payloads containing template expressions.
  • Unusual response sizes or content (e.g., system properties in the response).
• File IOCs:
  • Log entries showing template evaluation errors (e.g., FreeMarker template error).
• System IOCs:
  • Unexpected processes or network connections from the ThingsBoard server.

Detection Engineering

YARA Rule

rule CVE_2025_9094_SSTI_Payload {
    meta:
        description = "Detects SSTI payloads targeting ThingsBoard CVE-2025-9094"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9094"
    strings:
        $ssti1 = "${" ascii wide nocase
        $ssti2 = "{{" ascii wide nocase
        $ssti3 = "*{" ascii wide nocase
        $ssti4 = "#{" ascii wide nocase
        $ssti5 = "java.lang" ascii wide nocase
        $ssti6 = "Runtime" ascii wide nocase
        $ssti7 = "exec" ascii wide nocase
    condition:
        any of ($ssti*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-9094 - ThingsBoard SSTI Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with SSTI payloads targeting ThingsBoard
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-9094
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/gateway'
        cs-request-body|contains:
            - '${'
            - '{{'
            - '*{'
            - '#{'
    condition: selection
falsepositives:
    - Legitimate use of template expressions in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9094 - ThingsBoard SSTI Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/gateway"; http_uri; content:"${"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to ThingsBoard v4.2 or later when released.
2. Apply input validation and sanitization to all user-supplied data in the gateway handler.
3. Disable the vulnerable endpoint if not required.

Long-term Actions:

1. Implement a Web Application Firewall (WAF) to block SSTI payloads.
2. Conduct regular security audits and penetration testing.
3. Monitor for new patches and apply them promptly.

Workarounds:

• If upgrade is not possible, restrict access to the gateway handler to trusted IPs only.
• Use a reverse proxy to filter malicious requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert