CVE-2025-11908: Streamax Crocus RCE Vulnerability

CVE-2025-11908 Overview

CVE-2025-11908 is an unrestricted file upload vulnerability in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The flaw resides in the uploadFile function exposed through the /FileDir.do?Action=Upload endpoint. Attackers can manipulate the File argument to upload arbitrary content without restriction. The vulnerability is remotely exploitable across the network and requires only low-level privileges. Public exploit details have been released, increasing the risk of opportunistic abuse. The vendor was contacted prior to public disclosure but did not respond. The weakness is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control).

Critical Impact
Authenticated remote attackers can upload arbitrary files to a vulnerable Streamax Crocus deployment, potentially staging malicious payloads on the server with no vendor patch currently available.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus version 1.3.40
Component: uploadFile function in /FileDir.do?Action=Upload
Vendor: Streamax (Shenzhen Ruiming Technology)

Discovery Timeline

2025-10-17 - CVE-2025-11908 published to the National Vulnerability Database
2026-04-29 - Last updated in the NVD database

Technical Details for CVE-2025-11908

Vulnerability Analysis

The vulnerability is an unrestricted file upload weakness in the Crocus web management interface. The uploadFile handler reachable at /FileDir.do?Action=Upload accepts a File parameter without enforcing constraints on file type, extension, content, or destination. An authenticated remote attacker can submit a crafted HTTP request and place arbitrary files on the server file system. Because the upload bypasses both access control checks ([CWE-284]) and content validation ([CWE-434]), the resulting file can be used to stage tooling, overwrite assets, or place server-executable content if the upload directory falls within a script-executing path. Public exploit information is referenced in a GitHub technical document and indexed by VulDB entry 328918.

Root Cause

The uploadFile function does not validate the supplied File parameter against an allow-list of MIME types or extensions and does not normalize the destination path. The handler also fails to enforce sufficient authorization on the action, allowing any low-privileged session to invoke it. This combination of missing input validation and weak access control produces the unrestricted upload condition.

Attack Vector

An attacker with network access and a low-privilege account sends an HTTP POST request to /FileDir.do?Action=Upload with a multipart payload in the File field. The server stores the file under a predictable directory without sanitizing the filename or rejecting dangerous types. No user interaction is required and the attack can be scripted at scale against exposed Crocus management interfaces.

No verified proof-of-concept code is included here. Refer to the linked GitHub technical document for the publicly released exploitation details.

Detection Methods for CVE-2025-11908

Indicators of Compromise

Unexpected HTTP POST requests to /FileDir.do?Action=Upload from external or unusual source addresses.
New or modified files appearing in directories writable by the Crocus application service account.
Files with executable extensions (.jsp, .war, .sh, .bat) present in upload directories that normally hold media or document assets.
Outbound network connections originating from the Crocus application process shortly after upload activity.

Detection Strategies

Inspect web server and application logs for requests matching Action=Upload paired with non-standard Content-Type headers or oversized payloads.
Baseline normal upload patterns by source account and alert on deviations in volume, file size, or filename entropy.
Apply file integrity monitoring to Crocus upload and webroot directories to flag newly written executable content.

Monitoring Recommendations

Forward Crocus HTTP access logs to a centralized logging or SIEM platform for correlation with authentication events.
Monitor process creation by the Crocus service user, which should rarely spawn shells or interpreters.
Track filesystem write events under the application directory and correlate with the originating HTTP session.

How to Mitigate CVE-2025-11908

Immediate Actions Required

Restrict network reachability of the Crocus management interface to trusted administrative networks using firewall or VPN controls.
Rotate credentials for all Crocus accounts and disable any unused low-privilege users that could be abused to reach the upload endpoint.
Review upload directories for unauthorized files and quarantine any artifact that cannot be traced to a legitimate upload.
Enable verbose logging on the /FileDir.do endpoint and forward events to centralized monitoring.

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, Shenzhen Ruiming Technology did not respond to early contact attempts. Operators should monitor the VulDB advisory and vendor channels for any future fix and apply it immediately upon release.

Workarounds

Place the Crocus web interface behind a reverse proxy that blocks or rate-limits requests to /FileDir.do?Action=Upload.
Configure the upload directory with non-executable mount options where supported to prevent server-side execution of uploaded content.
Add a web application firewall rule to reject upload requests carrying dangerous extensions or script content.
Consider taking the affected version offline if business operations permit, until a vendor fix is published.

bash

# Example reverse proxy rule (nginx) to block the vulnerable endpoint
location = /FileDir.do {
    if ($arg_Action = "Upload") {
        return 403;
    }
    proxy_pass http://crocus_backend;
}