CVE-2025-11913
📋 TL;DR
This CVE describes a path traversal vulnerability in Shenzhen Ruiming Technology's Streamax Crocus system version 1.3.40. Attackers can remotely exploit the Download function to access arbitrary files on the server by manipulating the Path parameter. Organizations using this specific version of the Streamax Crocus system are affected.
💻 Affected Systems
- Shenzhen Ruiming Technology Streamax Crocus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through sensitive file disclosure (configuration files, credentials, system files) leading to further attacks or data exfiltration.
Likely Case
Unauthorized access to sensitive files containing configuration data, logs, or credentials that could enable lateral movement or privilege escalation.
If Mitigated
Limited file access restricted by proper input validation and file system permissions, preventing access to critical system files.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub. The vulnerability requires manipulation of the Path parameter in the Download function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Contact Shenzhen Ruiming Technology for updated version information and security patches.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to reject path traversal sequences (../, ..\) in the Path parameter
Implement web application firewall rules to block requests containing path traversal patterns
Access Restriction
allRestrict access to the vulnerable endpoint using network controls or authentication
Configure firewall rules to limit access to /Service.do?Action=Download from trusted sources only
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from critical assets
- Deploy a web application firewall (WAF) with rules to detect and block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Test if the /Service.do?Action=Download endpoint accepts path traversal sequences in the Path parameter (e.g., ../../../etc/passwd)Check Version:
Check system documentation or web interface for version information (likely displayed in admin panel)Verify Fix Applied:
Verify that path traversal attempts are rejected with proper error messages and no file access occurs📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /Service.do?Action=Download with suspicious Path parameters containing ../ patterns
- Access to unexpected system files from web server process
Network Indicators:
- Unusual file download patterns from the web server
- Requests attempting directory traversal sequences
SIEM Query:
web.url:*Service.do?Action=Download* AND (web.param.Path:*../* OR web.param.Path:*..\*)