CVE-2025-25286: Islandora Crayfish Homarus RCE Vulnerability

CVE-2025-25286 Overview

CVE-2025-25286 is a critical remote code execution vulnerability affecting the Homarus microservice within the Islandora Crayfish collection. Homarus provides FFmpeg as a microservice for Islandora 8 installations, and prior to version 4.1.0, certain configurations of web-accessible Homarus deployments are vulnerable to command injection attacks. The vulnerability stems from improper handling of CLI interpolation in the /convert endpoint, allowing attackers to execute arbitrary commands on the underlying server.

Critical Impact

Remote attackers can achieve full system compromise through command injection on Internet-exposed Homarus installations without requiring authentication in misconfigured deployments.

Affected Products

• Islandora Crayfish versions prior to 4.1.0
• Homarus microservice (FFmpeg-as-a-service component)
• Islandora 8 installations with web-accessible Homarus endpoints

Discovery Timeline

• 2025-02-13 - CVE-2025-25286 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2025-25286

Vulnerability Analysis

This vulnerability is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). The root issue lies in how the Homarus microservice processes user-supplied input when constructing command-line arguments for FFmpeg operations. When requests are made to the /convert endpoint, user-controlled data is interpolated directly into shell commands without adequate sanitization, creating an attack surface for command injection.

The impact is particularly severe for Internet-facing deployments where the Homarus service is directly accessible. Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the web server process, potentially leading to complete system compromise, data exfiltration, lateral movement within the network, and persistent backdoor installation.

Root Cause

The vulnerability originates from improper neutralization of special characters and escape sequences in the CLI interpolation logic within the Homarus controller. User-supplied parameters passed to the /convert endpoint are not properly sanitized before being incorporated into shell commands executed by the FFmpeg backend. This allows specially crafted input containing shell metacharacters to break out of the intended command context and execute arbitrary system commands.

Attack Vector

The attack is network-based and targets the /convert endpoint exposed by the Homarus microservice. An attacker can craft malicious HTTP requests containing command injection payloads in request parameters or headers. When the vulnerable code processes these requests, the injected commands are executed on the server. The attack requires no authentication in configurations where the Authorization header validation is not strictly enforced, significantly lowering the barrier to exploitation.

The security patch addresses this vulnerability by updating the islandora/crayfish-commons dependency and improving input handling in the HomarusController.php:

     "require": {
         "ext-ctype": "*",
         "ext-iconv": "*",
-        "islandora/crayfish-commons": "^4.0",
+        "islandora/crayfish-commons": "^4.1",
         "lexik/jwt-authentication-bundle": "^2.18",
         "symfony/dotenv": "5.4.*",
         "symfony/flex": "^1.3.1",

Source: GitHub Commit Reference

The controller changes include additional input handling via Symfony's HeaderBag:

 use Islandora\Crayfish\Commons\CmdExecuteService;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\HeaderBag;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;

Source: GitHub Commit Reference

Detection Methods for CVE-2025-25286

Indicators of Compromise

• Unusual HTTP requests to the Homarus /convert endpoint containing shell metacharacters (;, |, $(), backticks)
• Unexpected child processes spawned by the FFmpeg or web server process
• Anomalous outbound network connections from the Homarus service host
• Web server logs showing requests with encoded command sequences in parameters or headers

Detection Strategies

• Monitor web application firewall (WAF) logs for command injection patterns targeting /convert endpoints
• Implement runtime application self-protection (RASP) to detect shell command injection attempts
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process chains originating from web services
• Analyze HTTP request logs for unusual characters and encoding patterns indicative of injection attempts

Monitoring Recommendations

• Enable detailed logging for the Homarus microservice and review logs for anomalous request patterns
• Configure alerting for any unauthorized process execution by the web server user account
• Monitor system integrity for unexpected file modifications or new file creation in web-accessible directories
• Implement network segmentation monitoring to detect lateral movement attempts from compromised Homarus hosts

How to Mitigate CVE-2025-25286

Immediate Actions Required

• Upgrade to Islandora Crayfish version 4.1.0 or later immediately
• Restrict network access to Homarus microservice endpoints to internal networks only
• Configure strong authentication requirements in Crayfish to reject requests with invalid Authorization headers before CLI processing
• Review web server and application logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been patched in islandora/crayfish:4.1.0. The fix updates the islandora/crayfish-commons dependency to version ^4.1 and implements proper input sanitization in the HomarusController.php. Organizations should apply the patch by updating their Crayfish installation to version 4.1.0 or later. For detailed patch information, refer to the GitHub Security Advisory and the security commit.

Workarounds

• Block external Internet access to the Homarus microservice using firewall rules or reverse proxy configuration
• Configure Crayfish authentication to strictly validate Authorization headers, rejecting invalid requests before reaching vulnerable code paths
• Deploy a web application firewall (WAF) with command injection detection rules in front of Homarus endpoints
• Implement network segmentation to isolate Homarus services from critical infrastructure

# Example: Block external access to Homarus using iptables
# Allow only internal network (adjust IP range as needed)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP