CVE-2025-28367
📋 TL;DR
CVE-2025-28367 is a directory traversal vulnerability in mojoPortal's BetterImageGallery API Controller that allows attackers to read sensitive files like Web.Config. This exposes the MachineKey, which could lead to further compromise. All mojoPortal installations up to version 2.9.0.1 are affected.
💻 Affected Systems
- mojoPortal
📦 What is this software?
Mojoportal by Mojoportal
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain MachineKey, forge authentication tokens, escalate privileges, and potentially achieve remote code execution or full system compromise.
Likely Case
Attackers read Web.Config to obtain MachineKey, then forge authentication tokens to gain unauthorized access to the application.
If Mitigated
With proper input validation and access controls, exploitation attempts are blocked and logged without data exposure.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.0.2
Vendor Advisory: https://github.com/i7MEDIA/mojoportal
Restart Required: Yes
Instructions:
1. Backup your mojoPortal installation. 2. Download version 2.9.0.2 or later from the official repository. 3. Replace the affected files. 4. Restart the application server.
🔧 Temporary Workarounds
Block vulnerable endpoint
allConfigure web server to block access to /BetterImageGallery/ImageHandler endpoint
# For Apache: RewriteRule ^BetterImageGallery/ImageHandler - [F]
# For IIS: Add request filter rule
Input validation filter
windowsImplement input validation to reject directory traversal sequences
# In web.config: <add inputFilter="blockTraversal" />
🧯 If You Can't Patch
- Implement WAF rules to block directory traversal patterns in requests
- Restrict network access to mojoPortal to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if mojoPortal version is <=2.9.0.1 and BetterImageGallery is installedCheck Version:
Check web.config or admin panel for version informationVerify Fix Applied:
Verify version is >=2.9.0.2 and test directory traversal attempts are blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or '..\' patterns to /BetterImageGallery/ImageHandler
- Access attempts to Web.Config from unauthorized paths
Network Indicators:
- Unusual GET/POST requests with traversal sequences
- Requests for sensitive file paths
SIEM Query:
source="web_server" AND (uri="*BetterImageGallery/ImageHandler*" AND (uri="*../*" OR uri="*..\\*"))