CVE-2025-13810
📋 TL;DR
A path traversal vulnerability in jsnjfz WebStack-Guns 1.0 allows remote attackers to read arbitrary files on the server by manipulating the renderPicture function in KaptchaController.java. This affects all deployments of WebStack-Guns 1.0 that expose the vulnerable endpoint. Attackers can exploit this without authentication to access sensitive system files.
💻 Affected Systems
- jsnjfz WebStack-Guns
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, credentials, or private keys leading to further attacks.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user information stored on the server.
If Mitigated
Limited to reading non-critical files if proper file permissions and web server restrictions are in place.
🎯 Exploit Status
Proof of concept available in public GitHub repository. Simple HTTP request manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize file path parameters before processing
Implement path normalization and validation in renderPicture function to reject directory traversal sequences (../, ..\)
Web Server Restriction
allConfigure web server to restrict access to sensitive directories
nginx: location ~ ^/protected/ { deny all; }
Apache: <Directory "/var/www/sensitive"> Require all denied </Directory>
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable system from sensitive data
- Deploy WAF with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test by sending HTTP request to vulnerable endpoint with path traversal payload (e.g., GET /kaptcha/renderPicture?file=../../etc/passwd)Check Version:
Check application version in pom.xml or application.propertiesVerify Fix Applied:
Attempt exploitation with same payload; should receive error or sanitized response instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ or ..\ patterns
- Unusual file access patterns from web application logs
Network Indicators:
- HTTP requests with directory traversal sequences in parameters
SIEM Query:
web.url:*../* OR web.param:*../*