CVE-2020-25359
📋 TL;DR
CVE-2020-25359 is an arbitrary file deletion vulnerability in rConfig that allows attackers to delete all files with a specific extension in any directory accessible to the web server. Attackers can exploit this by sending crafted requests to a vulnerable endpoint. This affects rConfig installations that haven't been updated to version 3.9.6 or later.
💻 Affected Systems
- rConfig
📦 What is this software?
Rconfig by Rconfig
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, configuration files, or web application files leading to denial of service or privilege escalation.
Likely Case
Deletion of application logs, configuration files, or uploaded content causing service disruption and data loss.
If Mitigated
Limited impact if proper file permissions restrict web server write access to sensitive directories.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint with path and extension parameters. Public exploit code and detailed analysis are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.6
Vendor Advisory: https://github.com/rconfig/rconfig/releases/tag/v3.9.6
Restart Required: No
Instructions:
1. Backup your rConfig installation and database. 2. Download rConfig 3.9.6 or later from the official repository. 3. Replace the vulnerable file /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php with the patched version. 4. Verify the fix by checking the file contains proper input validation.
🔧 Temporary Workarounds
Delete vulnerable endpoint
linuxRemove or rename the vulnerable PHP file to prevent exploitation
mv /var/www/rconfig/lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php /var/www/rconfig/lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php.disabled
Web server access restriction
allBlock access to the vulnerable endpoint using web server configuration
# For Apache: add to .htaccess or virtual host config
<Files "ajaxDeleteAllLoggingFiles.php">
Order deny,allow
Deny from all
</Files>
# For Nginx: add to server block
location ~ /ajaxDeleteAllLoggingFiles\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate rConfig from other critical systems
- Enable detailed logging and monitoring for requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if file /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php exists and examine its code for lack of input validation on path and ext parameters.Check Version:
grep -r "rConfig version" /var/www/rconfig/ || cat /var/www/rconfig/install/version.txtVerify Fix Applied:
Verify the patched file contains proper input validation and path sanitization, or test with controlled requests to confirm file deletion is prevented.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php with path and ext parameters
- Multiple file deletion operations in system logs from web server user
Network Indicators:
- POST/GET requests to vulnerable endpoint with suspicious path traversal patterns
- Unusual file deletion patterns via web requests
SIEM Query:
source="web_server_logs" AND (uri="/lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php" OR uri LIKE "%/ajaxDeleteAllLoggingFiles.php") AND (query CONTAINS "path=" OR query CONTAINS "ext=")