CVE-2025-35430: CISA Thorium Path Traversal Vulnerability

CVE-2025-35430 Overview

CVE-2025-35430 is a path traversal vulnerability [CWE-22] in CISA Thorium, an open-source malware and forensic analysis platform maintained by the Cybersecurity and Infrastructure Security Agency (CISA). The flaw resides in the download_ephemeral and download_children functionality, which fails to adequately validate the paths of files served for download. A remote authenticated attacker can traverse the file system and retrieve arbitrary files subject to the process's file system permissions. The vendor addressed the issue in Thorium version 1.1.2.

Critical Impact
An authenticated remote attacker can read arbitrary files accessible to the Thorium service account, potentially exposing configuration secrets, credentials, and analysis artifacts.

Affected Products

CISA Thorium versions prior to 1.1.2
Deployments exposing the Thorium API to authenticated users
Self-hosted instances running the vulnerable bounder.rs path validation logic

Discovery Timeline

2025-09-17 - CVE-2025-35430 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-35430

Vulnerability Analysis

Thorium exposes two API operations, download_ephemeral and download_children, that stream files from server-side storage to authenticated clients. The path-bounding logic that normalizes and constrains requested paths does not sufficiently reject traversal sequences before opening files on disk. As a result, a caller who supplies crafted path components can escape the intended download directory and reference files elsewhere on the file system.

Because the attacker must authenticate first, exploitation requires valid Thorium credentials or an issued token. Once authenticated, any user role capable of invoking these download routes can request arbitrary paths. The impact is limited to confidentiality of files readable by the Thorium service account; integrity and availability are not directly affected by this class of read-only traversal.

Root Cause

The root cause is insufficient path canonicalization in the boundary-checking utility used by the affected download handlers. The relevant logic lives in api/src/utils/bounder.rs, where path normalization does not fully constrain user-supplied components to the intended base directory. See the GitHub source snippet referenced by the advisory.

Attack Vector

An attacker authenticates to the Thorium API over the network, then invokes download_ephemeral or download_children with a path parameter containing directory traversal segments. The server resolves the path outside the intended download root and returns the file contents. No user interaction beyond the attacker's own request is required. Refer to the CVE record and the CISA CSAF advisory for authoritative details.

Detection Methods for CVE-2025-35430

Indicators of Compromise

API request logs containing download_ephemeral or download_children endpoints with .. sequences, URL-encoded %2e%2e, or absolute paths in parameters.
Unexpected reads of sensitive host files such as /etc/passwd, /etc/shadow, service configuration files, or Thorium credential material.
Authenticated sessions issuing high volumes of download requests referencing paths outside the standard artifact storage tree.

Detection Strategies

Enable verbose request logging on the Thorium API and alert on path parameters that decode to traversal patterns.
Correlate authenticated user identity with the resolved file paths served to identify low-privilege accounts accessing sensitive locations.
Baseline normal download_children behavior per user role and flag deviations in path depth or target directory.

Monitoring Recommendations

Forward Thorium API access logs and host file access telemetry to a centralized analytics platform for correlation.
Monitor the Thorium service account for reads of files outside its expected working directories using file integrity and access auditing tools such as auditd.
Track version metadata across Thorium deployments to confirm all instances run 1.1.2 or later.

How to Mitigate CVE-2025-35430

Immediate Actions Required

Upgrade all Thorium instances to version 1.1.2 or later using the official 1.1.2 release.
Rotate any credentials, tokens, or secrets that were readable by the Thorium service account prior to patching.
Audit historical API logs for suspicious calls to download_ephemeral and download_children and investigate any anomalous path parameters.

Patch Information

CISA released Thorium 1.1.2 with corrected path validation in the bounder.rs utility. Administrators should follow the standard upgrade procedure documented in the project repository and verify service health post-upgrade. The fix and release notes are available in the Thorium 1.1.2 release notes.

Workarounds

Restrict Thorium API access to trusted networks and enforce least-privilege roles until the upgrade is completed.
Run the Thorium service under a dedicated, unprivileged system account with file system permissions limited to required directories.
Place the API behind a reverse proxy that inspects and rejects request parameters containing traversal sequences.

bash

# Example reverse proxy rule (NGINX) rejecting traversal patterns
location ~* /(download_ephemeral|download_children) {
    if ($args ~* "(\.\./|%2e%2e/|%2e%2e%2f)") {
        return 400;
    }
    proxy_pass http://thorium_backend;
}