CVE-2025-13435: Dreampie Resty Path Traversal Flaw

CVE-2025-13435 Overview

A path traversal vulnerability has been identified in Dreampie Resty up to version 1.3.1.SNAPSHOT. This security flaw affects the Request function within the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the HttpClient Module. Through manipulation of the filename argument, attackers can achieve path traversal, potentially allowing unauthorized access to files outside the intended directory structure. The attack can be performed remotely over the network, though exploitation is considered highly complex and difficult.

Critical Impact

Remote attackers can exploit improper input validation in the HttpClient Module to traverse file system paths, potentially accessing sensitive files or directories outside the application's intended scope.

Affected Products

• Dreampie Resty up to version 1.3.1.SNAPSHOT
• Resty HttpClient Module (/resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java)
• Applications utilizing the vulnerable Request function with user-controlled filename parameters

Discovery Timeline

• 2025-11-20 - CVE-2025-13435 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-13435

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the Dreampie Resty HTTP client library, specifically within the Request function of the HttpClient.java file. The vulnerability stems from insufficient validation of the filename argument, which allows attackers to inject directory traversal sequences such as ../ to escape the intended directory structure.

The exploit has been publicly disclosed, and while the vendor was contacted early during the responsible disclosure process, no response was received. This lack of vendor engagement means that no official patch is currently available, leaving users to implement their own mitigations.

Root Cause

The root cause of this vulnerability is improper input validation in the HttpClient Module's Request function. The function fails to adequately sanitize or validate the filename parameter before using it in file system operations. This allows specially crafted input containing directory traversal sequences to be processed, enabling attackers to reference files and directories outside the application's intended scope.

Attack Vector

The attack is network-based, meaning it can be launched remotely without requiring local access to the target system. However, the exploitation complexity is noted as high, making successful attacks more difficult to execute. The attacker would need to craft malicious requests that include path traversal sequences in the filename parameter to access or manipulate files outside the designated directory.

The vulnerability mechanism involves passing malicious input containing path traversal sequences (such as ../ or encoded variants) through the filename argument of the Request function in the HttpClient Module. When processed without proper sanitization, these sequences allow the application to access files outside the intended directory hierarchy.

For detailed technical analysis, refer to the GitHub CVE Application Guide and the VulDB CTI Report #332979.

Detection Methods for CVE-2025-13435

Indicators of Compromise

• Unusual file access attempts containing path traversal sequences (../, ..\\, or URL-encoded variants like %2e%2e%2f) in application logs
• HTTP requests to the Resty HttpClient endpoints with suspicious filename parameters
• Access logs showing attempts to read sensitive configuration files or system directories
• Error messages indicating file path resolution outside expected directories

Detection Strategies

• Implement input validation monitoring to detect path traversal patterns in API requests targeting the HttpClient Module
• Deploy web application firewall (WAF) rules to identify and block requests containing directory traversal sequences
• Monitor application logs for anomalous file access patterns that deviate from normal operational behavior
• Utilize runtime application self-protection (RASP) solutions to detect path manipulation attempts

Monitoring Recommendations

• Enable detailed logging for all file system operations within applications using Dreampie Resty
• Configure alerts for requests containing path traversal indicators such as ../, ..\\, or encoded equivalents
• Implement baseline monitoring for file access patterns and alert on deviations
• Review access logs periodically for attempts to access sensitive system files or directories

How to Mitigate CVE-2025-13435

Immediate Actions Required

• Audit all applications using Dreampie Resty 1.3.1.SNAPSHOT or earlier to identify exposure to this vulnerability
• Implement input validation at the application layer to reject filename parameters containing path traversal sequences
• Consider replacing or wrapping the vulnerable Request function with a secure implementation that sanitizes file paths
• Restrict network access to affected endpoints where possible until a permanent fix is available

Patch Information

No official vendor patch is currently available. The vendor was contacted during the disclosure process but did not respond. Users should implement workarounds and monitor for any future security updates from Dreampie. For additional vulnerability details, refer to the VulDB entry #332979.

Workarounds

• Implement strict input validation to sanitize the filename parameter, rejecting any input containing ../, ..\\, or encoded path traversal sequences
• Use allowlisting to restrict accepted filenames to known-safe values or patterns
• Apply the principle of least privilege to file system permissions, limiting what files the application can access
• Deploy a web application firewall (WAF) with rules configured to block path traversal attempts

# Example input validation approach for Java applications
# Add validation before passing filename to HttpClient Request function
# Reject inputs containing path traversal sequences:
# - Deny: "../", "..\", "%2e%2e%2f", "%2e%2e%5c"
# - Canonicalize paths and verify they remain within intended directory
# - Use allowlisting for acceptable filename patterns where possible