CVE-2025-35055
📋 TL;DR
This vulnerability allows authenticated attackers to upload arbitrary files to any writable location in Newforma Info Exchange (NIX), potentially enabling web shell deployment and directory deletion. Combined with CVE-2025-35062 (anonymous access enabled by default), unauthenticated attackers can exploit this as 'anonymous' users. Affects NIX installations before version 2023.1.
💻 Affected Systems
- Newforma Info Exchange (NIX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via web shell leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Web shell installation allowing persistent access, data exfiltration, and potential privilege escalation.
If Mitigated
Limited impact if proper authentication controls and file upload restrictions are in place.
🎯 Exploit Status
Combination with CVE-2025-35062 allows unauthenticated exploitation. Simple HTTP POST requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1 or later
Vendor Advisory: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json
Restart Required: Yes
Instructions:
1. Upgrade to NIX version 2023.1 or later. 2. Apply all security patches from Newforma. 3. Restart the NIX application services.
🔧 Temporary Workarounds
Disable Anonymous Access
windowsDisable anonymous user authentication in NIX configuration to prevent unauthenticated exploitation.
Configure in NIX administration panel: Security Settings > Authentication > Disable Anonymous Access
Block Vulnerable Endpoint
windowsUse web application firewall or IIS URL rewrite to block access to '/UserWeb/Common/UploadBlueimp.ashx'.
IIS URL Rewrite rule: <rule name="BlockUploadBlueimp" stopProcessing="true"><match url="^UserWeb/Common/UploadBlueimp\.ashx" /><action type="AbortRequest" /></rule>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NIX servers from critical systems.
- Deploy web application firewall with file upload filtering and malicious content detection.
🔍 How to Verify
Check if Vulnerable:
Check NIX version in administration panel. If version is below 2023.1, system is vulnerable.Check Version:
Check NIX web interface: Admin > System Information > VersionVerify Fix Applied:
Verify NIX version is 2023.1 or later. Test that anonymous access is disabled and the upload endpoint rejects unauthorized requests.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to '/UserWeb/Common/UploadBlueimp.ashx' with suspicious file extensions (.aspx, .php, .jsp)
- Unauthenticated access attempts to upload endpoints
- File creation in unexpected web directories
Network Indicators:
- Unusual outbound connections from NIX server
- HTTP requests with webshell payloads in POST data
SIEM Query:
source="iis" AND (url="*UploadBlueimp.ashx*" OR cs_uri_stem="/UserWeb/Common/UploadBlueimp.ashx") AND (cs_method="POST")