CVE-2025-54769: Xorux Lpar2rrd Path Traversal Vulnerability

CVE-2025-54769 Overview

CVE-2025-54769 is a directory traversal vulnerability in Xorux LPAR2RRD that allows authenticated, read-only users to upload files to arbitrary filesystem locations. An attacker can overwrite existing PERL modules used by the application to achieve remote code execution. The flaw is categorized under [CWE-24] (Path Traversal: '../filedir') and carries a network attack vector with low privileges required.

Critical Impact
Any authenticated read-only account can pivot to full remote code execution on the LPAR2RRD host by overwriting trusted PERL modules, breaking the principle of least privilege and granting attackers control of the monitoring server.

Affected Products

Xorux LPAR2RRD (all versions prior to the vendor fix referenced in note800)
Deployments exposing the LPAR2RRD web interface to authenticated users
Stor2RRD installations sharing the same vulnerable upload code path

Discovery Timeline

2025-07-29 - CVE-2025-54769 published to NVD
2025-11-03 - Last updated in NVD database
Vendor and researcher details documented in the KoreLogic Security Advisory KL-001-2025-016 and the Full Disclosure Mailing List Post

Technical Details for CVE-2025-54769

Vulnerability Analysis

LPAR2RRD is a Perl-based performance monitoring application for IBM Power Systems and virtualized infrastructure. The application exposes an authenticated file upload endpoint that fails to sanitize user-supplied path components. By submitting an upload request containing ../ traversal sequences in the destination filename, an attacker can place arbitrary content outside the intended upload directory.

Because LPAR2RRD itself is implemented in Perl, the application loads .pm modules from known paths at runtime. Overwriting one of these modules with attacker-controlled Perl code causes the malicious payload to execute the next time the application invokes the module. This converts a file upload primitive into reliable remote code execution under the privileges of the LPAR2RRD web service account.

Root Cause

The root cause is missing path canonicalization and validation on the upload handler. The application accepts a destination path parameter and concatenates it with a base directory without rejecting .. sequences or enforcing a path prefix check. Authorization logic gates the endpoint behind authentication but does not differentiate between read-only and administrative roles for upload operations.

Attack Vector

Exploitation requires a valid low-privilege account on the LPAR2RRD web interface. The attacker authenticates, identifies a writable Perl module on disk such as a module under the application's lib directory, and issues an upload request with a traversal payload pointing to that module's filesystem location. The next request that triggers loading of the overwritten module executes the attacker's Perl code in the context of the web application user. Technical reproduction steps are documented in the KoreLogic advisory.

Detection Methods for CVE-2025-54769

Indicators of Compromise

Web server access logs showing POST requests to LPAR2RRD upload endpoints containing ../ or URL-encoded %2e%2e%2f sequences in parameters
Unexpected modification timestamps on .pm files under the LPAR2RRD installation directory
New or modified Perl files outside the standard upload directory owned by the web service account
Outbound network connections initiated by the LPAR2RRD Perl process to unfamiliar hosts

Detection Strategies

Hash and baseline all Perl modules in the LPAR2RRD install path and alert on deviations
Inspect HTTP request bodies and query strings for directory traversal patterns targeting the upload endpoint
Correlate authenticated session activity from read-only accounts with file write events on the host
Monitor process lineage where the LPAR2RRD Perl interpreter spawns shells or network utilities

Monitoring Recommendations

Enable file integrity monitoring on /home/lpar2rrd, /opt/lpar2rrd, and any custom installation paths
Forward web server and application logs to a centralized SIEM for traversal pattern matching
Alert on any write activity targeting .pm files outside scheduled maintenance windows
Review authentication logs for read-only accounts performing upload actions, which is anomalous by design

How to Mitigate CVE-2025-54769

Immediate Actions Required

Apply the vendor update referenced in the LPAR2RRD Technical Note immediately
Restrict network access to the LPAR2RRD web interface to trusted management networks only
Audit existing user accounts and remove unused read-only credentials
Verify integrity of all installed Perl modules against a known-good baseline

Patch Information

Xorux has published guidance and a fixed release on the vendor advisory page. Administrators should follow the upgrade procedure documented in the LPAR2RRD Technical Note and confirm the application version after upgrading. The KoreLogic advisory provides the coordinated disclosure details and validates that the fixed release addresses the traversal issue.

Workarounds

Place the LPAR2RRD web interface behind a reverse proxy that strips or rejects requests containing ../ sequences
Apply filesystem ACLs to make Perl module directories read-only for the web service account where feasible
Disable or remove non-essential authenticated accounts until the patch is deployed
Run the LPAR2RRD service under a dedicated low-privilege user with no write access to its own code directories

bash

# Example reverse proxy rule (nginx) to block traversal patterns
location /lpar2rrd-cgi/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://lpar2rrd_backend;
}