CVE-2025-15432
📋 TL;DR
This is a path traversal vulnerability in yeqifu carRental software that allows attackers to access arbitrary files on the server by manipulating the 'path' parameter in the downloadShowFile function. The vulnerability affects all versions up to commit 3fabb7eae93d209426638863980301d6f99866b3. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- yeqifu carRental
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or source code, potentially leading to complete system compromise if credentials or secrets are exposed.
Likely Case
Unauthorized access to application files, configuration data, or other sensitive information stored on the server.
If Mitigated
Limited impact if proper file permissions and input validation are implemented, restricting access to only intended files.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub issue #46. The vulnerability is simple to exploit with basic HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. The vendor has been notified but has not responded. Consider implementing workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject path traversal sequences like '../' in the path parameter
Implement input sanitization in the downloadShowFile function to validate path parameters
Web Application Firewall Rule
allBlock requests containing path traversal patterns in URL parameters
Add WAF rule to block requests with '../' or similar patterns in query parameters
🧯 If You Can't Patch
- Restrict file system permissions to limit what files the application can access
- Implement network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /file/downloadShowFile.action with a path parameter containing '../' sequences and observe if it returns files outside the intended directoryCheck Version:
Check the Git commit hash of the deployed carRental instanceVerify Fix Applied:
Test the same path traversal attempts and verify they are rejected or return error messages📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /file/downloadShowFile.action with '../' in parameters
- Unusual file access patterns from the application
Network Indicators:
- HTTP requests with path traversal sequences in URL parameters
SIEM Query:
url:*/file/downloadShowFile.action* AND (path:*../* OR param:*../*)