CVE-2025-61686 Vulnerability Analysis Report

Vulnerability Overview

CVE ID: CVE-2025-61686
Affected Versions: @react-router/node 7.0.0 to 7.9.3
Vulnerability Type: Path Traversal / Directory Traversal

Vulnerability Principle

1. Vulnerability Location

The vulnerability exists in the getFile() function and related file operation logic in the packages/react-router-node/sessions/fileStorage.ts file.

2. Core Issue Analysis

2.1 Source of Session ID

In packages/react-router/lib/server-runtime/sessions.ts, line 267:

async getSession(cookieHeader, options) {
  let id = cookieHeader && (await cookie.parse(cookieHeader, options));
  let data = id && (await readData(id));
  return createSession(data || {}, id || "");
}

The session ID is parsed from the cookie via the cookie.parse() method.

2.2 Cookie Parsing Logic

In the decodeCookieValue() function of packages/react-router/lib/server-runtime/cookies.ts:

async function decodeCookieValue(
  value: string,
  secrets: string[],
): Promise<any> {
  if (secrets.length > 0) {
    // If secrets are configured, signature verification is performed
    for (let secret of secrets) {
      let unsignedValue = await unsign(value, secret);
      if (unsignedValue !== false) {
        return decodeData(unsignedValue);
      }
    }
    return null;  // Returns null if signature verification fails
  }
  
  // If no secrets configured (unsigned), directly return the decoded value
  return decodeData(value);
}

Key Issue: When the cookie is unsigned (secrets is an empty array or not set), decodeCookieValue directly returns the decoded cookie value, allowing an attacker to fully control this value.

2.3 Path Construction Logic

In packages/react-router-node/sessions/fileStorage.ts:

export function getFile(dir: string, id: string): string {
  // Divide the session id up into a directory (first 2 bytes) and filename
  // (remaining 6 bytes) to reduce the chance of having very large directories,
  return path.join(dir, id.slice(0, 4), id.slice(4));
}

This function splits the session ID into two parts:

• First 4 characters as directory name: id.slice(0, 4)
• Remaining characters as filename: id.slice(4)

Then uses path.join() to concatenate the path.

2.4 Exploitation Method

Attack Scenario: When using createFileSessionStorage() with an unsigned cookie:

1. The attacker can forge a malicious session ID, e.g., ../../etc/passwd
2. getFile() processing:
   • id.slice(0, 4) = ../.
   • id.slice(4) = /etc/passwd
   • path.join(dir, ../., /etc/passwd)
   • Although path.join() normalizes paths, path traversal may still be possible if dir is already relative or after processing

More precise exploitation:

• Session ID: ....//etc/passwd
  • id.slice(0, 4) = ....
  • id.slice(4) = //etc/passwd
  • If handled improperly, could lead to accessing /etc/passwd

Or:

• Session ID: ../../../etc/passwd (16 characters)
  • id.slice(0, 4) = ../.
  • id.slice(4) = ./etc/passwd
  • Combined with the behavior of path.join(), path traversal could occur

3. Affected Operations

The following file operations are potentially affected:

1. readData(id) - When reading session data

   root@kitploit:~

   async readData(id) {
     try {
       let file = getFile(dir, id);
       let content = JSON.parse(await fsp.readFile(file, "utf-8"));
       // ...
     }
   }
   

2. updateData(id, data, expires) - When updating session data

   root@kitploit:~

   async updateData(id, data, expires) {
     let content = JSON.stringify({ data, expires });
     let file = getFile(dir, id);
     await fsp.mkdir(path.dirname(file), { recursive: true });
     await fsp.writeFile(file, content, "utf-8");
   }
   

3. deleteData(id) - When deleting session data

   root@kitploit:~

   async deleteData(id) {
     try {
       await fsp.unlink(getFile(dir, id));
     }
   }
   

4. Attack Impact

1. File Read: Attackers may read arbitrary files on the server (depending on the web server process privileges)
2. File Write: Attackers may write files on the server, potentially leading to:
   • Data leakage
   • Code injection
   • Privilege escalation
3. File Deletion: Attackers may delete files on the server

5. Vulnerability Trigger Conditions

The following conditions must all be met:

1. Use of the createFileSessionStorage() method
2. Cookie unsigned (secrets not set or empty array in the cookie configuration)
3. The web server process has read/write permissions on the target file

Code Audit Findings

Key Code Path

getSession(cookieHeader) 
  → cookie.parse(cookieHeader) 
    → decodeCookieValue(value, secrets)  // When unsigned, directly returns the value
      → readData(id) 
        → getFile(dir, id)  // Path concatenation, risk of path traversal
          → fsp.readFile(file) / fsp.writeFile(file) / fsp.unlink(file)

Root Cause

1. Lack of Input Validation: The getFile() function does not validate or normalize the id parameter
2. Reliance on path.join() Normalization: Although path.join() normalizes paths, path traversal may still be allowed under specific circumstances (e.g., when the preceding path already contains ..)
3. Unsigned Cookie: Allows an attacker to fully control the value of the session ID