CVE-2025-29331
📋 TL;DR
A critical vulnerability in MHSanaei 3x-ui management panel allows remote attackers to execute arbitrary code by exploiting insecure certificate validation during update downloads. This affects all systems running 3x-ui versions before 2.5.3. Attackers can compromise the entire system through the management interface.
💻 Affected Systems
- MHSanaei 3x-ui
📦 What is this software?
3x Ui by Mhsanaei
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing installation of persistent backdoors, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to cryptocurrency mining, ransomware deployment, or credential theft from the compromised server.
If Mitigated
Limited impact if management interface is not internet-facing and proper network segmentation is in place.
🎯 Exploit Status
Exploitation requires network access to the management interface. The vulnerability is in the update script that uses wget with --no-check-certificate flag.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.3
Vendor Advisory: https://github.com/MHSanaei/3x-ui/pull/2661
Restart Required: No
Instructions:
1. Backup current configuration. 2. Stop 3x-ui service. 3. Update to version 2.5.3 or later. 4. Restart 3x-ui service. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Management Interface Internet Access
linuxBlock external access to the 3x-ui management port (typically 2053/tcp)
iptables -A INPUT -p tcp --dport 2053 -j DROP
ufw deny 2053/tcp
Disable Automatic Updates
linuxPrevent the vulnerable update mechanism from being triggered
sed -i 's/auto_update=true/auto_update=false/g' /etc/x-ui/x-ui.db
🧯 If You Can't Patch
- Implement strict network ACLs to allow only trusted IPs to access the management interface
- Monitor for suspicious outbound connections from the 3x-ui server, particularly to unknown domains
🔍 How to Verify
Check if Vulnerable:
Check if version is below 2.5.3: x-ui version | grep -q '2.5.3' || echo 'Vulnerable'Check Version:
x-ui versionVerify Fix Applied:
Verify version is 2.5.3 or higher: x-ui version | grep -E '2\.5\.3|2\.5\.[4-9]|2\.[6-9]'📡 Detection & Monitoring
Log Indicators:
- Unusual wget commands in system logs
- Failed certificate validation attempts
- Unexpected process execution from 3x-ui user
Network Indicators:
- Outbound connections to unusual domains from 3x-ui server
- HTTP requests with --no-check-certificate flag
SIEM Query:
process.name:wget AND cmdline:*--no-check-certificate* AND user.name:x-ui