CVE-2025-65602
📋 TL;DR
An unauthenticated remote code execution vulnerability in ChanCMS v3.3.4 allows attackers to execute arbitrary code via template injection in the /vip/v1/file/save endpoint. This affects all deployments of ChanCMS v3.3.4 that have the vulnerable component accessible. Attackers can gain complete control of affected systems without authentication.
💻 Affected Systems
- ChanCMS
📦 What is this software?
Chancms by Chancms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Initial access leading to web server compromise, data exfiltration, and cryptocurrency mining malware deployment.
If Mitigated
Limited impact if system is isolated, has strict network controls, and minimal privileges, though code execution still possible.
🎯 Exploit Status
Exploitation requires only a crafted HTTP POST request to the vulnerable endpoint. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check the ChanCMS repository for updates or consider migrating to alternative software.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allBlock access to the /vip/v1/file/save endpoint using web server configuration or WAF rules
# Apache: RewriteRule ^/vip/v1/file/save - [F]
# Nginx: location ~ ^/vip/v1/file/save { return 403; }
Network Segmentation
linuxRestrict network access to ChanCMS instances to only trusted sources
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
# iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and critical internal networks
- Implement strict WAF rules to block requests containing template injection patterns to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if ChanCMS version is 3.3.4 and the /vip/v1/file/save endpoint responds to POST requests. Test with a non-malicious payload to confirm endpoint functionality.Check Version:
Check ChanCMS configuration files or admin interface for version information. Look for version indicators in source code or documentation.Verify Fix Applied:
Verify the vulnerable endpoint is no longer accessible or returns appropriate error codes. Test with the same verification method used to check vulnerability.📡 Detection & Monitoring
Log Indicators:
- POST requests to /vip/v1/file/save with unusual payloads
- Web server logs showing template syntax in POST data
- System logs showing unexpected process execution
Network Indicators:
- HTTP POST requests to /vip/v1/file/save with encoded template syntax
- Outbound connections from ChanCMS server to suspicious IPs post-exploitation
SIEM Query:
source="web_server_logs" AND uri_path="/vip/v1/file/save" AND http_method="POST" AND (payload CONTAINS "{{" OR payload CONTAINS "{%" OR payload CONTAINS "%}")