CVE-2025-11018: Four-Faith Path Traversal Vulnerability

CVE-2025-11018 Overview

CVE-2025-11018 is a path traversal vulnerability [CWE-22] in Four-Faith Water Conservancy Informatization Platform 1.0. The flaw resides in the handling of the fileName argument processed through the endpoint /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Remote attackers can manipulate this parameter to traverse directories and access files outside the intended download scope. The vendor was contacted prior to disclosure but did not respond. A public disclosure exists and the exploit has been published, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the underlying filesystem of vulnerable Four-Faith deployments, exposing configuration data and credentials.

Affected Products

Four-Faith Water Conservancy Informatization Platform 1.0
Component: generalReport/download.do file download handler
CPE: cpe:2.3:a:four-faith:water_conservancy_informatization:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-09-26 - CVE-2025-11018 published to NVD
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-11018

Vulnerability Analysis

The vulnerability is a classic path traversal flaw in a Java-based web application endpoint. The vulnerable URL combines path normalization tricks and matrix parameters: /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. This construction allows attackers to bypass URL-based authentication or routing filters that whitelist endpoints such as usrlogout.do, while the servlet container resolves the request to the protected download.do handler.

Once the request reaches the download handler, the fileName argument is concatenated into a filesystem path without sanitization. Supplying traversal sequences such as ../ lets an attacker escape the intended report directory and read arbitrary files. Because the issue is reachable without authentication and requires only a crafted HTTP request, exploitation is straightforward against exposed installations.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The application trusts user-controlled input for the fileName parameter and fails to canonicalize the resulting path or enforce that the resolved file lies within an allowed base directory. Additionally, the use of matrix parameter syntax (;usrlogout.do.do) suggests that authentication or routing filters in front of the servlet are bypassed through URL parsing differences between the filter chain and the dispatcher.

Attack Vector

The attack is delivered over the network with no authentication and no user interaction required. An attacker issues an HTTP GET request to the vulnerable endpoint, setting fileName to a traversal payload pointing at sensitive files such as application configuration, database credentials, or operating system files readable by the service account. Successful exploitation yields confidential file contents in the HTTP response.

No verified proof-of-concept code is referenced in NVD. See the GitHub CVE Issue and VulDB entry #325961 for additional technical details.

Detection Methods for CVE-2025-11018

Indicators of Compromise

HTTP requests to /generalReport/download.do containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the fileName query parameter.
Requests targeting /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do or similar matrix-parameter constructions used to bypass authentication filters.
Anomalous outbound responses from the application server containing contents of system files such as /etc/passwd, web.xml, or application configuration files.

Detection Strategies

Inspect web server and application access logs for download.do requests with traversal patterns in query strings.
Deploy WAF rules to flag and block path traversal signatures against the Four-Faith application context.
Correlate file-read events on the application host with concurrent HTTP requests to the download endpoint.

Monitoring Recommendations

Enable verbose request logging on the Four-Faith web tier, including full URL and query parameters.
Monitor for unusual file-access patterns from the JVM process serving the application.
Alert on repeated 200-status responses to download.do requests issued by previously unseen source IPs.

How to Mitigate CVE-2025-11018

Immediate Actions Required

Restrict network access to the Four-Faith Water Conservancy Informatization Platform so it is reachable only from trusted management networks or via VPN.
Deploy a WAF or reverse proxy rule that rejects requests containing .., encoded traversal sequences, or matrix parameters on download.do.
Audit application and operating system files for evidence of unauthorized read access since the platform was first exposed.

Patch Information

No vendor patch has been published. The vendor did not respond to disclosure attempts according to the public advisory. Organizations should treat all internet-exposed instances as vulnerable and prioritize compensating controls until a fix is released. Monitor the VulDB CTI entry #325961 for updates.

Workarounds

Place the application behind an authenticating reverse proxy that normalizes URLs and strips matrix parameters before forwarding requests.
Run the application service under a least-privilege account with filesystem ACLs that deny read access to sensitive system and configuration files.
Block public access to the /generalReport/download.do endpoint at the network edge if it is not required for external users.

bash

# Example nginx rule to block traversal attempts and matrix parameter bypass
location ~* /generalReport/download\.do {
    if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") { return 403; }
    if ($request_uri ~* ";usrlogout") { return 403; }
    proxy_pass http://four_faith_backend;
}