CVE-2025-13435
📋 TL;DR
CVE-2025-13435 is a path traversal vulnerability in Dreampie Resty's HttpClient module that allows attackers to access arbitrary files on the server by manipulating filename parameters. This affects Dreampie Resty up to version 1.3.1.SNAPSHOT. The vulnerability can be exploited remotely but requires complex attack conditions.
💻 Affected Systems
- Dreampie Resty
📦 What is this software?
Resty by Dreampie
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or application source code, potentially leading to credential theft, system compromise, or data exfiltration.
Likely Case
Limited file read access within the application's directory or accessible file system paths, potentially exposing configuration files or application data.
If Mitigated
With proper input validation and file system restrictions, impact would be limited to non-sensitive files or prevented entirely.
🎯 Exploit Status
Exploit has been publicly disclosed but requires specific conditions and parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative libraries.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for filename parameters to prevent path traversal sequences
Implement validation to reject filenames containing '../', '..\', or absolute paths
File System Restrictions
allConfigure application to run with minimal file system permissions and restrict accessible directories
Use Java Security Manager or containerization to limit file access
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns in requests
- Monitor file access logs for unusual patterns and implement alerting for suspicious file access attempts
🔍 How to Verify
Check if Vulnerable:
Check if application uses Dreampie Resty HttpClient module version ≤1.3.1.SNAPSHOT and processes filename parameters without validationCheck Version:
Check Maven/Gradle dependencies for 'cn.dreampie:resty-httpclient' versionVerify Fix Applied:
Test with path traversal payloads (e.g., '../../etc/passwd') to ensure they are rejected📡 Detection & Monitoring
Log Indicators:
- Requests containing '../' or '..\' sequences in filename parameters
- Unusual file access patterns from HttpClient module
Network Indicators:
- HTTP requests with suspicious path sequences in parameters
SIEM Query:
http.uri contains "../" OR http.uri contains "..\\"