CVE-2025-6534
📋 TL;DR
This vulnerability in novel-plus allows remote attackers to delete arbitrary files due to missing authorization checks in the file removal function. It affects all systems running novel-plus up to version 5.1.3. Attackers can exploit this to delete critical system files, though exploitation requires high complexity.
💻 Affected Systems
- xxyopen/201206030 novel-plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, configuration files, or application data leading to service disruption or data loss.
Likely Case
Application data corruption or deletion, potentially causing service disruption or loss of user-uploaded content.
If Mitigated
Minimal impact with proper file permission controls and network segmentation limiting file deletion to non-critical directories.
🎯 Exploit Status
Exploit code has been publicly disclosed, but successful exploitation requires specific knowledge of the system and high technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version beyond 5.1.3 if available, or implement workarounds.
🔧 Temporary Workarounds
Implement Authorization Checks
allAdd proper authorization checks to the FileController.java remove function to verify user permissions before file deletion.
Modify novel-admin/src/main/java/com/java2nb/common/controller/FileController.java to include authentication and authorization validation
Restrict File Deletion Permissions
linuxConfigure file system permissions to limit what files the novel-plus application user can delete.
chmod -R 755 /path/to/novel-plus/uploads
chown -R www-data:www-data /path/to/novel-plus/uploads
🧯 If You Can't Patch
- Implement network segmentation to isolate novel-plus servers from critical systems
- Deploy file integrity monitoring to detect unauthorized file deletions
🔍 How to Verify
Check if Vulnerable:
Check the novel-plus version. If version is 5.1.3 or earlier, the system is vulnerable.Check Version:
Check application configuration files or admin panel for version informationVerify Fix Applied:
Test file deletion functionality with unauthorized users to ensure proper authorization checks are in place.📡 Detection & Monitoring
Log Indicators:
- Unauthorized file deletion attempts in application logs
- Failed authentication attempts followed by file operations
Network Indicators:
- Unusual HTTP POST requests to file deletion endpoints from unexpected sources
SIEM Query:
source="novel-plus" AND (action="delete" OR action="remove") AND user="unauthenticated"🔗 References
- https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion
- https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion#poc
- https://vuldb.com/?ctiid.313653
- https://vuldb.com/?id.313653
- https://vuldb.com/?submit.596505
- https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion
