CVE-2025-11913: Streamax Crocus Path Traversal Vulnerability

CVE-2025-11913 Overview

CVE-2025-11913 is a path traversal vulnerability [CWE-22] in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The flaw resides in the Download function handling requests to /Service.do?Action=Download. An attacker can manipulate the Path parameter to traverse directories and access files outside the intended download directory. The vulnerability is remotely exploitable and requires low-level privileges. The exploit has been publicly disclosed, and the vendor was contacted about the issue but did not respond.

Critical Impact
Authenticated remote attackers can read arbitrary files on the host filesystem by injecting traversal sequences into the Path argument of the Download action.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus 1.3.40
Vendor: Streamax (Shenzhen Ruiming Technology)
Component: Service.do endpoint, Download function

Discovery Timeline

2025-10-17 - CVE-2025-11913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11913

Vulnerability Analysis

The vulnerability exists in the file download handler exposed at /Service.do?Action=Download. The Download function accepts a client-supplied Path parameter and uses it to construct the target file location without properly validating or normalizing the input. As a result, an authenticated attacker can supply traversal sequences such as ../ to escape the intended download directory and read arbitrary files accessible to the service process.

The underlying weakness is classified as Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. Exploitation requires network access to the Crocus web service and low-privilege credentials, but no user interaction. Successful exploitation results in disclosure of files such as configuration data, application binaries, or credentials stored on the host.

Root Cause

The Download function does not canonicalize the Path parameter or enforce a whitelist of permitted directories before opening the requested file. Missing input validation allows traversal metacharacters to be interpreted by the filesystem layer, breaking the boundary between the intended download root and the rest of the disk.

Attack Vector

An attacker sends a crafted HTTP request to /Service.do?Action=Download with a Path value containing directory traversal sequences. The request is issued over the network against the exposed Crocus web interface. Because the parameter is passed directly to the file-open logic, the server returns the contents of any file the service account can read. No exploit code is required beyond a standard HTTP client. Refer to the GitHub Resource Document and the VulDB entry for the disclosed request pattern.

Detection Methods for CVE-2025-11913

Indicators of Compromise

HTTP requests to /Service.do with Action=Download where the Path parameter contains ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths.
Access log entries showing the Download action returning sensitive system files such as /etc/passwd, Windows configuration files, or Crocus application config.
Unusual outbound file transfers originating from the Crocus service account outside normal operational windows.

Detection Strategies

Deploy web application firewall (WAF) or IDS signatures that flag directory traversal patterns in query strings targeting Service.do.
Correlate authenticated Crocus sessions with anomalous Download request volumes or diverse Path values requested by a single account.
Perform file integrity and access auditing on directories outside the designated download root to detect unauthorized reads.

Monitoring Recommendations

Enable verbose HTTP access logging on the Crocus front-end and retain logs long enough to support retrospective analysis.
Alert on 200-status responses to Download requests whose Path parameter contains traversal metacharacters.
Monitor low-privileged accounts for behavioral deviations such as bulk downloads or attempts to enumerate the filesystem.

How to Mitigate CVE-2025-11913

Immediate Actions Required

Restrict network exposure of the Crocus management interface to trusted administrative networks only.
Rotate any credentials that may have been stored on the affected host, assuming potential prior exposure.
Audit historical HTTP logs for traversal attempts against /Service.do?Action=Download and investigate any matches.

Patch Information

No vendor patch is currently available. According to the disclosure, the vendor was contacted but did not respond. Track the VulDB advisory and vendor communications for updates. Until a fix is published, apply the compensating controls described below.

Workarounds

Place the Crocus web service behind a reverse proxy or WAF that blocks traversal patterns (../, ..\, %2e%2e%2f) in query parameters.
Enforce filesystem-level access controls so the Crocus service account can only read files within the intended download directory.
Disable or firewall the /Service.do?Action=Download endpoint if it is not required for production operations.

bash

# Example NGINX rule to block traversal in the Path parameter
location /Service.do {
    if ($arg_Path ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://crocus_backend;
}