CVE-2025-8344
📋 TL;DR
This critical vulnerability in openviglet shio allows remote attackers to upload arbitrary files without restrictions via the shStaticFileUpload function. Attackers can potentially upload malicious files to execute code or compromise the server. All users running shio versions up to 0.3.8 are affected.
💻 Affected Systems
- openviglet shio
📦 What is this software?
Shio by Viglet
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
File system manipulation, web shell upload for persistent access, or denial of service
If Mitigated
Limited to file uploads within controlled directories with proper permissions
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues, making exploitation straightforward
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.9 or later
Vendor Advisory: https://github.com/openviglet/shio/issues/1029
Restart Required: Yes
Instructions:
1. Check current shio version. 2. Update to version 0.3.9 or later. 3. Restart the shio application. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable static file upload endpoint
allTemporarily disable the vulnerable shStaticFileUpload API endpoint
Modify shio configuration to disable /api/staticfile/upload endpoint
Implement file upload validation
allAdd server-side validation for file extensions, MIME types, and content
Implement file validation in ShStaticFileAPI.java before processing uploads
🧯 If You Can't Patch
- Implement strict network access controls to limit access to the upload endpoint
- Deploy a web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if shio version is 0.3.8 or earlier and if the static file upload endpoint is accessibleCheck Version:
Check application properties or build files for version informationVerify Fix Applied:
Verify shio version is 0.3.9 or later and test file upload with malicious extensions📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with suspicious extensions (.jsp, .php, .exe)
- Multiple failed upload attempts
- Uploads to unexpected directories
Network Indicators:
- HTTP POST requests to /api/staticfile/upload with unusual file types
- Increased upload traffic
SIEM Query:
source="shio" AND (url="/api/staticfile/upload" OR method="POST") AND (file_extension IN ("jsp", "php", "exe", "sh"))