CVE-2025-3324
📋 TL;DR
CVE-2025-3324 is a critical unrestricted file upload vulnerability in Nimrod 0.8's FileRestController.java that allows remote attackers to upload arbitrary files. This can lead to remote code execution or server compromise. Anyone running vulnerable Nimrod instances is affected.
💻 Affected Systems
- godcheese/code-projects Nimrod
📦 What is this software?
Nimrod by Godcheese
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent backdoor access, file system manipulation, and potential privilege escalation.
If Mitigated
Upload attempts blocked at WAF level with no successful exploitation, though attack attempts may still be logged.
🎯 Exploit Status
Public exploit available on GitHub, making this easily exploitable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check for official patch from godcheese/code-projects repository. 2. If patch available, apply and restart Nimrod service. 3. Verify fix by testing file upload functionality.
🔧 Temporary Workarounds
WAF File Upload Filtering
allConfigure web application firewall to block malicious file uploads based on file extensions and content.
Disable File Upload Endpoint
allTemporarily disable or restrict access to the vulnerable FileRestController endpoint.
🧯 If You Can't Patch
- Implement strict file upload validation on reverse proxy/WAF layer
- Isolate Nimrod instance in network segment with minimal access
🔍 How to Verify
Check if Vulnerable:
Test file upload functionality with malicious file extensions (.jsp, .php, .exe) to see if they're accepted.Check Version:
Check Nimrod version in application configuration or via API endpoint if available.Verify Fix Applied:
Attempt same malicious file uploads after remediation - should be rejected with proper validation.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with suspicious extensions
- Multiple failed upload attempts
- Successful uploads of executable files
Network Indicators:
- HTTP POST requests to file upload endpoints with unusual file types
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="nimrod" AND (http_method="POST" AND uri="*upload*" AND (file_extension="jsp" OR file_extension="php" OR file_extension="exe"))