CVE-2025-12923
📋 TL;DR
This vulnerability in ChestnutCMS allows attackers to perform path traversal attacks via the resourceDownload function, enabling unauthorized file reads. Attackers can remotely exploit this to access sensitive files on the server. Systems running ChestnutCMS versions up to 1.5.8 are affected.
💻 Affected Systems
- liweiyi ChestnutCMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive server files like configuration files, credentials, or source code, potentially leading to further compromise.
Likely Case
Unauthorized reading of application files, configuration data, or other sensitive information stored on the server.
If Mitigated
Limited impact if proper file permissions and input validation are in place, though the vulnerability still exists.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading if a patched version becomes available or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the path parameter to prevent directory traversal sequences.
Web Application Firewall Rule
allAdd WAF rules to block requests containing directory traversal patterns like ../ or absolute paths.
🧯 If You Can't Patch
- Restrict access to the /dev-api/common/download endpoint using network controls or authentication.
- Implement strict file system permissions to limit what files the web server process can read.
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /dev-api/common/download with a path parameter containing directory traversal sequences (e.g., ../../../etc/passwd).Check Version:
Check the CMS version in the admin panel or configuration files.Verify Fix Applied:
Verify that path traversal attempts are blocked or sanitized, and only allowed files can be accessed.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /dev-api/common/download with path parameters containing ../ or similar sequences.
Network Indicators:
- HTTP requests to /dev-api/common/download with suspicious path values.
SIEM Query:
source="web_logs" AND uri_path="/dev-api/common/download" AND (uri_query="*../*" OR uri_query="*..\\*" OR uri_query="*%2e%2e%2f*")