CVE-2025-46661: Ipwsystems Metazo RCE Vulnerability

CVE-2025-46661 Overview

CVE-2025-46661 is a critical Server-Side Template Injection (SSTI) vulnerability affecting IPW Systems Metazo through version 8.1.3. The vulnerability exists in the smartyValidator.php component, which allows unauthenticated attackers to provide malicious template expressions that are executed on the server, resulting in Remote Code Execution (RCE). This vulnerability requires no authentication and can be exploited remotely over the network, making it particularly dangerous for exposed Metazo installations.

Critical Impact

Unauthenticated attackers can achieve full Remote Code Execution on affected Metazo servers through Server-Side Template Injection, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• IPW Systems Metazo versions through 8.1.3
• All Metazo installations prior to vendor-applied patches

Discovery Timeline

• 2025-04-28 - CVE-2025-46661 published to NVD
• 2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-46661

Vulnerability Analysis

This vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) and CWE-94 (Improper Control of Generation of Code). The root issue lies in the smartyValidator.php component, which processes user-supplied input as Smarty template expressions without proper sanitization or validation.

Server-Side Template Injection occurs when an application embeds user input into template expressions that are then evaluated by the template engine. In this case, the Smarty template engine processes attacker-controlled data, allowing arbitrary PHP code execution on the server. Since the vulnerability requires no authentication and is accessible over the network, any exposed Metazo instance is at immediate risk.

Root Cause

The vulnerability stems from improper input validation in the smartyValidator.php file. User-supplied data is passed directly to the Smarty template engine for evaluation without adequate sanitization, allowing attackers to inject malicious template directives. Smarty templates can execute arbitrary PHP code through various template tags and modifiers, which the attacker can leverage to gain code execution on the underlying server.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can craft HTTP requests containing malicious Smarty template expressions targeting the vulnerable smartyValidator.php endpoint. When the server processes these requests, the injected template code is evaluated by the Smarty engine, executing the attacker's payload with the privileges of the web server process.

Typical SSTI payloads in Smarty templates leverage tags like {php}, {system()}, or other callable functions to execute operating system commands or PHP code. The unauthenticated nature of this vulnerability significantly increases the attack surface, as no credentials or prior access is required.

Detection Methods for CVE-2025-46661

Indicators of Compromise

• Unusual HTTP requests to smartyValidator.php containing Smarty template syntax such as {php}, {system}, {exec}, or {passthru}
• Web server logs showing requests with encoded or obfuscated template injection patterns
• Unexpected process spawning from web server processes (e.g., sh, bash, cmd.exe)
• Outbound network connections from web server processes to unknown external hosts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SSTI payload patterns targeting Smarty templates
• Monitor HTTP request parameters for template injection indicators including curly braces with PHP function names
• Deploy endpoint detection solutions to identify anomalous process execution chains originating from web server processes
• Analyze web server access logs for requests targeting smartyValidator.php with suspicious query parameters or POST data

Monitoring Recommendations

• Enable verbose logging on Metazo installations to capture full request parameters
• Configure SIEM alerts for requests containing common SSTI patterns (e.g., {if}, {php}, {eval}, {system})
• Monitor for file system modifications in web-accessible directories that could indicate webshell deployment
• Track network connections from web server processes to identify potential command-and-control communications

How to Mitigate CVE-2025-46661

Immediate Actions Required

• Contact IPW Systems to confirm your Metazo instance has received the vendor-applied patch
• Restrict network access to Metazo installations using firewall rules until patching is confirmed
• Review web server logs for any evidence of exploitation attempts against smartyValidator.php
• Consider temporarily disabling or restricting access to the vulnerable endpoint if immediate patching is not possible

Patch Information

According to the vendor advisory, all Metazo instances have been patched by IPW Systems. Organizations should verify with the vendor that their installation has received the security update. For additional information, refer to IPW Systems and the Code White Vulnerability List.

Workarounds

• Implement network segmentation to isolate Metazo servers from untrusted networks and the public internet
• Deploy a Web Application Firewall (WAF) with rules to block requests containing Smarty template injection patterns
• Restrict access to smartyValidator.php at the web server configuration level if the functionality is not required
• Enable additional authentication layers or IP-based access controls for the Metazo application

# Example: Apache configuration to restrict access to vulnerable endpoint
<Files "smartyValidator.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>