Overview
CVE-2025-13435 describes a medium-severity path traversal vulnerability found in Dreampie Resty up to version 1.3.1.SNAPSHOT. This vulnerability resides within the HttpClient Module, specifically affecting the Request function in the HttpClient.java file. A remote attacker can exploit this flaw by manipulating the filename argument, potentially gaining unauthorized access to sensitive files and directories on the server.
Technical Details
The vulnerability stems from insufficient sanitization of the filename parameter within the Request function of /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java. An attacker can inject directory traversal sequences (e.g., ../) into the filename argument. This allows the attacker to bypass intended access restrictions and potentially read arbitrary files on the system, or in some cases write to arbitrary locations depending on server configuration.
The vendor was contacted regarding this issue but did not respond.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) v3.0 score for CVE-2025-13435 is 5.6 (Medium). The CVSS vector is not available, but the score reflects the following factors:
- Attack Vector: Network (Remote Exploitation)
- Attack Complexity: High (Requires specialized knowledge and potentially timing-dependent exploitation)
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low (Potentially sensitive information can be exposed)
- Integrity Impact: None
- Availability Impact: None
While the attack complexity is high, the public availability of an exploit increases the risk of successful exploitation.
Possible Impact
A successful path traversal attack can lead to several critical security risks:
- Data Leakage: Exposure of sensitive configuration files, application code, or user data.
- System Compromise: In some scenarios, the attacker might be able to upload malicious files, potentially leading to remote code execution and full system compromise.
- Denial of Service: While less likely, an attacker could potentially overwrite critical system files, causing a denial of service.
Mitigation and Patch Steps
Since the vendor has not provided a patch, the following mitigation steps are recommended:
- Input Validation: Implement strict input validation and sanitization on the
filenameparameter. Reject any input containing directory traversal sequences like../or absolute paths. - Path Normalization: Utilize path normalization techniques to resolve symbolic links and canonicalize the path before accessing the file.
- Least Privilege Principle: Ensure that the application runs with the minimum necessary privileges. Limit the application’s access to only the required directories and files.
- Web Application Firewall (WAF): Implement a WAF rule to detect and block path traversal attempts.
- Consider Migration: If possible, consider migrating to a more actively maintained HTTP client library.
