CVE-2025-12922
📋 TL;DR
This vulnerability allows remote attackers to perform path traversal attacks via the xml_file parameter in OpenClinica's CRF Data Import component. Attackers can potentially access or manipulate files outside the intended directory. All OpenClinica Community Edition installations up to version 3.12.2/3.13 are affected.
💻 Affected Systems
- OpenClinica Community Edition
📦 What is this software?
Openclinica by Openclinica
Openclinica by Openclinica
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution, sensitive data exposure, or complete system compromise through file manipulation
Likely Case
Unauthorized file access, data leakage, or configuration file tampering
If Mitigated
Limited impact with proper file permission restrictions and input validation
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to block path traversal sequences in xml_file parameter
# Configure web application firewall or input validation rules to block ../, ..\, and similar sequences
Access Restriction
allRestrict access to /ImportCRFData endpoint
# Use web server configuration (Apache/Nginx) to restrict access to specific IPs or require authentication
🧯 If You Can't Patch
- Implement strict file system permissions to limit what directories the application can access
- Deploy a web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check if OpenClinica version is 3.12.2/3.13 or earlier and has the /ImportCRFData endpoint accessibleCheck Version:
# Check OpenClinica version in application interface or configuration filesVerify Fix Applied:
Test the vulnerability by attempting path traversal through the xml_file parameter📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /ImportCRFData with xml_file parameter containing ../ or similar sequences
- File access errors for unexpected paths
Network Indicators:
- HTTP requests with path traversal patterns in parameters
- Unusual file access patterns from web server
SIEM Query:
web.url:*ImportCRFData* AND (web.param:*../* OR web.param:*..\*)🔗 References
- https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md
- https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged
- https://vuldb.com/?ctiid.331642
- https://vuldb.com/?id.331642
- https://vuldb.com/?submit.680873
- https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md
- https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged
