CVE-2025-27410
📋 TL;DR
CVE-2025-27410 is a path traversal vulnerability in PwnDoc's backup restore functionality that allows authenticated administrators to overwrite arbitrary files on the system. By overwriting JavaScript files and restarting the container, attackers can achieve remote code execution with administrative privileges. This affects all PwnDoc installations prior to version 1.2.0.
💻 Affected Systems
- PwnDoc (pwndoc)
📦 What is this software?
Pwndoc by Pwndoc Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution leading to data theft, lateral movement, and persistent backdoors.
Likely Case
Administrative account takeover leading to unauthorized access to penetration test reports and sensitive client data.
If Mitigated
Limited impact if proper access controls restrict backup functionality to trusted administrators only.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated. The vulnerability is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/pwndoc/pwndoc/security/advisories/GHSA-mxw8-vgvx-89hx
Restart Required: Yes
Instructions:
1. Stop the PwnDoc container. 2. Pull the latest image: 'docker pull pwndoc/pwndoc:1.2.0'. 3. Update docker-compose.yml to use version 1.2.0. 4. Restart the container: 'docker-compose up -d'.
🔧 Temporary Workarounds
Disable backup functionality
allRemove backup permissions from all users to prevent exploitation
Modify user roles to remove 'backups:create' and 'backups:update' permissions
Restrict admin access
allImplement strict access controls and MFA for administrative accounts
🧯 If You Can't Patch
- Implement network segmentation to isolate PwnDoc instances from critical systems
- Enable comprehensive logging and monitoring of backup-related activities and file modifications
🔍 How to Verify
Check if Vulnerable:
Check PwnDoc version via web interface or container inspection: 'docker exec <container_name> cat /app/package.json | grep version'Check Version:
docker exec pwndoc_container cat /app/package.json | grep versionVerify Fix Applied:
Confirm version is 1.2.0 or higher and test backup restore functionality with malicious path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual backup restore activities
- File modification events in system directories
- Administrative account login anomalies
Network Indicators:
- Unexpected outbound connections from PwnDoc container
- Suspicious file uploads to backup endpoints
SIEM Query:
source="pwnedoc" AND (event="backup_restore" OR event="file_write") AND path CONTAINS ".."🔗 References
- https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L527
- https://github.com/pwndoc/pwndoc/commit/98f284291d73d3a0b11d3181d845845c192d1080
- https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0
- https://github.com/pwndoc/pwndoc/security/advisories/GHSA-mxw8-vgvx-89hx
- https://github.com/pwndoc/pwndoc/security/advisories/GHSA-mxw8-vgvx-89hx
