CVE-2025-57785: Hiawatha Webserver RCE Vulnerability

CVE-2025-57785 Overview

A Double Free vulnerability has been identified in the XSLT show_index function of Hiawatha webserver version 11.7. This memory corruption flaw allows an unauthenticated attacker to corrupt data, potentially leading to arbitrary code execution. Double Free vulnerabilities occur when memory is freed more than once, which can corrupt the memory allocator's internal data structures and allow an attacker to manipulate program execution.

Critical Impact

Unauthenticated remote attackers can exploit this Double Free vulnerability to corrupt memory and potentially achieve arbitrary code execution on affected Hiawatha webserver installations.

Affected Products

• Hiawatha webserver version 11.7

Discovery Timeline

• 2026-01-26 - CVE CVE-2025-57785 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2025-57785

Vulnerability Analysis

This vulnerability stems from improper memory management in the XSLT show_index functionality of the Hiawatha webserver. The Double Free condition occurs when the same memory region is passed to the free() function more than once. In typical scenarios, this can lead to heap corruption, which attackers can leverage to overwrite critical data structures or function pointers.

The vulnerability is exploitable over the network without requiring authentication, making it particularly dangerous for internet-facing Hiawatha webserver deployments. An attacker could craft malicious requests that trigger the show_index functionality in a way that causes the Double Free condition, potentially allowing them to gain control of the affected system.

Root Cause

The root cause of this vulnerability lies in the memory deallocation logic within the xslt.c source file, specifically around line 675. The code path responsible for generating index listings via XSLT processing fails to properly track memory allocation state, resulting in the same memory pointer being freed multiple times during request processing. This typically occurs when error handling paths or cleanup routines do not account for memory that has already been released.

Attack Vector

The attack vector is network-based, allowing remote exploitation without user interaction. An attacker can send specially crafted HTTP requests to a vulnerable Hiawatha webserver that trigger the XSLT index generation functionality. By manipulating request parameters or exploiting specific timing conditions, the attacker can cause the Double Free condition to occur.

The exploitation process typically involves:

1. Identifying a Hiawatha webserver with XSLT show_index functionality enabled
2. Sending crafted requests to trigger the vulnerable code path
3. Manipulating heap metadata through the Double Free to achieve arbitrary write capabilities
4. Overwriting function pointers or other critical data to redirect execution flow

Technical details about the vulnerable code can be found in the GitLab Code Review.

Detection Methods for CVE-2025-57785

Indicators of Compromise

• Unexpected crashes or segmentation faults in the Hiawatha webserver process
• Unusual memory consumption patterns in the web server process
• Suspicious HTTP requests targeting directory listing or index generation endpoints
• Core dumps indicating heap corruption or Double Free conditions

Detection Strategies

• Monitor Hiawatha webserver logs for unusual patterns in requests to directories with XSLT-based index generation
• Implement web application firewall rules to detect and block malformed requests targeting index functionality
• Deploy memory corruption detection tools such as AddressSanitizer on staging environments to identify exploitation attempts
• Use intrusion detection systems with signatures for common Double Free exploitation patterns

Monitoring Recommendations

• Enable verbose logging on Hiawatha webserver instances to capture detailed request information
• Configure process monitoring to alert on unexpected webserver restarts or crashes
• Implement network traffic analysis to detect anomalous request patterns to index endpoints
• Set up crash dump collection and analysis for rapid incident response

How to Mitigate CVE-2025-57785

Immediate Actions Required

• Identify all Hiawatha webserver version 11.7 installations in your environment
• Consider disabling XSLT-based directory indexing functionality if not required
• Implement network-level access controls to limit exposure of affected servers
• Monitor affected servers closely for signs of exploitation attempts

Patch Information

Organizations should check the official Hiawatha webserver project for updated versions that address this vulnerability. The vulnerable code is located in src/xslt.c at line 675, and patches should address the improper memory deallocation in the show_index functionality. Refer to the GitLab Code Review for details on the affected code section.

Workarounds

• Disable XSLT-based directory indexing in Hiawatha configuration if the feature is not essential
• Place affected Hiawatha servers behind a reverse proxy with request filtering capabilities
• Implement strict access controls to limit which clients can access directory listing functionality
• Consider temporarily switching to static index files instead of dynamically generated XSLT indexes

# Example: Disable ShowIndex in Hiawatha configuration
# Edit hiawatha.conf and ensure ShowIndex is set to no for sensitive directories
# ShowIndex = no