CVE-2025-1845
📋 TL;DR
This critical vulnerability in ESAFENET DSM 3.1.2 allows remote attackers to execute arbitrary commands via command injection in the examExportPDF function. Attackers can exploit this to gain unauthorized access and control over affected systems. Organizations using ESAFENET DSM 3.1.2 are at risk.
💻 Affected Systems
- ESAFENET DSM
📦 What is this software?
Dsm by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, steal sensitive data, install malware, or pivot to other systems in the network.
Likely Case
Remote code execution leading to data exfiltration, system disruption, or deployment of ransomware.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are in place, though exploitation remains possible.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Monitor vendor communications for updates and apply immediately when released.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
allRestrict access to the /admin/plan/examExportPDF endpoint using web application firewall (WAF) rules or network controls.
Input Validation and Sanitization
allImplement strict input validation and sanitization for the 's' parameter to prevent command injection.
🧯 If You Can't Patch
- Isolate affected systems from the internet and restrict network access to only necessary services.
- Implement strict monitoring and alerting for suspicious activity on the /admin/plan/examExportPDF endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if ESAFENET DSM version 3.1.2 is installed and if the /admin/plan/examExportPDF endpoint is accessible.Check Version:
Check the ESAFENET DSM administration interface or configuration files for version information.Verify Fix Applied:
Verify that the vendor has released a patched version and that the /admin/plan/examExportPDF endpoint no longer accepts malicious input.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /admin/plan/examExportPDF
- Commands executed from the web process
Network Indicators:
- Suspicious HTTP requests to /admin/plan/examExportPDF with command injection payloads
SIEM Query:
source="web_logs" AND uri="/admin/plan/examExportPDF" AND (payload="|" OR payload="$" OR payload="&")