CVE-2025-34160: AnyShare ServiceAgent API RCE Vulnerability

CVE-2025-34160 Overview

CVE-2025-34160 is a critical unauthenticated remote code execution vulnerability affecting Aishu AnyShare, an enterprise content collaboration platform. The vulnerability exists in the ServiceAgent API exposed on port 10250, where the /api/ServiceAgent/start_service endpoint accepts user-supplied input via POST requests without proper sanitization. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution on vulnerable systems.

This command injection vulnerability (CWE-78) allows remote attackers to execute arbitrary operating system commands without any authentication requirements. The exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC, indicating active exploitation attempts in the wild.

Critical Impact

Unauthenticated attackers can achieve full system compromise through arbitrary command execution on AnyShare servers via the exposed ServiceAgent API on port 10250.

Affected Products

• Aishu AnyShare (builds released prior to August 2025)
• AnyShare Family 7 series products
• AnyShare instances with ServiceAgent API exposed on port 10250

Discovery Timeline

• 2025-07-11 - Exploitation evidence first observed by Shadowserver Foundation
• 2025-08-27 - CVE CVE-2025-34160 published to NVD
• 2025-08-29 - Last updated in NVD database

Technical Details for CVE-2025-34160

Vulnerability Analysis

The vulnerability resides in the ServiceAgent API component of AnyShare, specifically in the /api/ServiceAgent/start_service endpoint. This endpoint is designed to manage service operations but fails to implement proper input validation and sanitization for user-supplied data in POST request bodies. When processing service-related parameters, the backend directly incorporates user input into operating system command strings without escaping shell metacharacters.

The network-accessible nature of this vulnerability on port 10250, combined with the lack of authentication requirements, creates a severe attack surface. Any attacker with network access to the vulnerable endpoint can achieve arbitrary command execution with the privileges of the AnyShare service account.

Root Cause

The root cause is an OS Command Injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The /api/ServiceAgent/start_service endpoint processes user-supplied input and passes it directly to shell command execution functions without sanitizing or validating command-like payloads. This allows attackers to break out of the intended command context by injecting shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax.

Attack Vector

The attack is conducted remotely over the network by sending a crafted POST request to the vulnerable endpoint. The attacker targets port 10250 where the ServiceAgent API is exposed and submits a malicious payload containing shell syntax to the /api/ServiceAgent/start_service endpoint.

The attack sequence involves:

1. Identifying AnyShare instances with the ServiceAgent API accessible on port 10250
2. Crafting a POST request to /api/ServiceAgent/start_service with command injection payloads embedded in the request body
3. The vulnerable backend concatenates the unsanitized input into a system command
4. The injected shell commands are executed with the privileges of the AnyShare service process

For detailed technical analysis and proof-of-concept information, refer to the VulnCheck Advisory on AnyShare RCE.

Detection Methods for CVE-2025-34160

Indicators of Compromise

• Unexpected HTTP POST requests to /api/ServiceAgent/start_service on port 10250
• Request bodies containing shell metacharacters such as ;, |, $(), or backticks
• Unusual child processes spawned by the AnyShare service process
• Network connections from AnyShare servers to unexpected external addresses
• Command execution artifacts in system logs associated with the AnyShare service account

Detection Strategies

• Monitor network traffic for POST requests to port 10250 targeting the /api/ServiceAgent/start_service endpoint
• Implement web application firewall (WAF) rules to detect command injection patterns in request bodies
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process execution chains originating from AnyShare processes
• Analyze HTTP request logs for payloads containing common shell injection syntax patterns
• Configure intrusion detection systems (IDS) with signatures for command injection attempts

Monitoring Recommendations

• Enable detailed logging for all ServiceAgent API requests and responses
• Set up alerts for any POST requests to the vulnerable endpoint from untrusted sources
• Monitor process creation events on AnyShare servers for anomalous command execution
• Track network connections initiated by AnyShare service processes to detect potential reverse shells or data exfiltration

How to Mitigate CVE-2025-34160

Immediate Actions Required

• Block external access to port 10250 at the network perimeter using firewall rules
• Implement network segmentation to restrict access to the ServiceAgent API to trusted management networks only
• Audit AnyShare servers for signs of compromise and investigate any suspicious activity
• Apply updated AnyShare versions that contain the remediation for this vulnerability
• Review and restrict network access to all administrative API endpoints

Patch Information

The vulnerability is reported to be remediated in newer versions of AnyShare released after August 2025. Organizations should contact Aishu directly or consult the Aishu Tech AnyShare Overview page for the latest patched versions and upgrade instructions. The exact affected version range remains undefined by the vendor.

For additional technical details and advisory information, refer to the VulnCheck Advisory on AnyShare RCE.

Workarounds

• Restrict access to port 10250 to only trusted IP addresses or management networks
• Deploy a reverse proxy or web application firewall in front of the ServiceAgent API to filter malicious requests
• Disable the ServiceAgent API if it is not required for operations
• Implement network-level access controls to prevent untrusted systems from reaching AnyShare administrative interfaces
• Consider temporarily taking vulnerable AnyShare instances offline until patches can be applied

# Example: Block external access to ServiceAgent API port using iptables
iptables -A INPUT -p tcp --dport 10250 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 10250 -j DROP