CVE-2025-8753
📋 TL;DR
This critical vulnerability in litemall allows attackers to perform path traversal attacks via the delete function in the file handler component. Remote attackers can manipulate the 'key' parameter to delete arbitrary files on the server. All users running litemall versions up to 1.8.0 are affected.
💻 Affected Systems
- linlinjava litemall
📦 What is this software?
Litemall by Linlinjava
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or privilege escalation.
Likely Case
Unauthorized deletion of application files, configuration files, or user data causing service disruption and data loss.
If Mitigated
Limited impact with proper file permission restrictions and input validation, potentially only affecting non-critical files.
🎯 Exploit Status
Exploit has been publicly disclosed in GitHub issues. Attack requires access to admin storage delete endpoint but does not require authentication to the vulnerability itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.1 or later
Vendor Advisory: https://github.com/linlinjava/litemall/issues/564
Restart Required: No
Instructions:
1. Update litemall to version 1.8.1 or later. 2. Check the GitHub issue for specific patch details. 3. Verify the fix by testing the delete functionality with path traversal attempts.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject file paths containing directory traversal sequences
Implement validation to reject paths containing '../', '..\\', or absolute paths
Access Restriction
allRestrict access to the /admin/storage/delete endpoint using network controls or authentication
Configure firewall rules or web server ACLs to limit access to admin endpoints
🧯 If You Can't Patch
- Implement strict file permission controls to limit what files the application user can delete
- Deploy a web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test the /admin/storage/delete endpoint with path traversal payloads like '../../etc/passwd' in the key parameterCheck Version:
Check litemall version in application configuration or via package manager: typically in pom.xml for versionVerify Fix Applied:
Attempt the same path traversal attacks after patching; they should be rejected with proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual delete operations with path traversal patterns in request logs
- Failed delete attempts with error messages related to invalid paths
- Multiple delete requests to admin storage endpoint
Network Indicators:
- HTTP requests to /admin/storage/delete containing '../' sequences
- Unusual patterns of file deletion requests
SIEM Query:
source="web_logs" AND uri="/admin/storage/delete" AND (request_body CONTAINS "../" OR request_body CONTAINS "..\\")