CVE-2025-59334: Mohammadzain2008 Linkr RCE Vulnerability

CVE-2025-59334 Overview

CVE-2025-59334 is a cryptographic signature verification vulnerability in Linkr, a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 fail to verify the integrity or authenticity of .linkr manifest files before processing their contents. This allows attackers to inject arbitrary file entries into package distributions by tampering with manifest files.

Critical Impact

An attacker can modify a generated .linkr manifest to add malicious URLs, causing unsuspecting users to download attacker-controlled files when running the extract command. This creates a direct path to arbitrary file injection and potential remote code execution if malicious binaries or scripts are subsequently executed.

Affected Products

• Linkr versions up to and including 2.0.0
• mohammadzain2008 Linkr package distribution systems
• Any systems utilizing Linkr for file delivery without manifest integrity verification

Discovery Timeline

• 2025-09-16 - CVE-2025-59334 published to NVD
• 2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-59334

Vulnerability Analysis

This vulnerability stems from a fundamental lack of cryptographic verification in Linkr's manifest processing pipeline. The .linkr manifest file serves as a central control mechanism that dictates which files should be downloaded and from where. Without integrity checks, the system implicitly trusts any manifest it processes, regardless of whether it has been modified since creation.

The attack surface is significant because manifest files may be transmitted or stored in locations where an attacker could intercept and modify them. Once tampered, the manifest directs the Linkr client to download arbitrary files from attacker-controlled URLs. Since these downloads occur without verification, malicious executables, scripts, or configuration files can be silently injected into the target system.

The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), highlighting the missing authentication mechanism that should validate manifest origin and integrity. User interaction is required to trigger exploitation, as the victim must execute the extract command on a tampered manifest.

Root Cause

The root cause is the absence of manifest integrity verification in Linkr versions through 2.0.0. The extract functionality processes .linkr manifest files without comparing them against an original author-created checksum or verifying cryptographic signatures. This design flaw allows any modification to a manifest file to go undetected, enabling arbitrary injection of download entries.

Attack Vector

The attack requires network access and user interaction:

1. An attacker obtains or intercepts a legitimate .linkr manifest file
2. The attacker modifies the manifest to include additional entries pointing to malicious URLs
3. The tampered manifest is distributed to victims (via compromised hosting, man-in-the-middle, or social engineering)
4. When a victim runs the Linkr extract command on the malicious manifest, the client downloads attacker-supplied files without verification
5. If the downloaded malicious files (binaries or scripts) are later executed, remote code execution is achieved

The security patch in version 2.0.1 addresses this by implementing manifest integrity verification:

-import sys
 from linkr_compressor import linkr_compressor
 from linkr_extractor import linkr_extractor
 
-from global_var import VERSION
+from global_var import CLI_VERSION as VERSION
 
 print("="*50)
-print(f"Welcome to Linkr v{VERSION}!")
+print(f"Linkr v{VERSION}!")
 print("Linkr is a tool to package folders into .linkr files with download links, and extract them later.")
 print("For more information, visit: https://github.com/mohammadzain2008/Linkr")
 print("="*50)

Source: GitHub Commit Update

The fix introduces checksum comparison between the original author-created manifest and the one being extracted, aborting the operation on mismatch and warning users if no original manifest is hosted for verification.

Detection Methods for CVE-2025-59334

Indicators of Compromise

• Unexpected or unauthorized files appearing after Linkr extract operations
• Network connections to unknown or suspicious URLs during Linkr extraction
• Modified .linkr manifest files with entries not matching original package contents
• Execution of unexpected binaries or scripts following Linkr package extraction

Detection Strategies

• Monitor file system changes following Linkr extract operations for unexpected file creation
• Implement network monitoring to detect connections to unauthorized download sources during Linkr operations
• Compare manifest file hashes against known-good values before extraction
• Enable logging for Linkr CLI and GUI operations to capture download activities

Monitoring Recommendations

• Deploy endpoint detection to flag execution of newly downloaded files from Linkr operations
• Implement integrity monitoring on directories where Linkr extracts packages
• Set up alerts for Linkr processes making connections to non-whitelisted domains
• Review Linkr operation logs for unusual download patterns or unfamiliar URLs

How to Mitigate CVE-2025-59334

Immediate Actions Required

• Update Linkr to version 2.0.1 or later immediately
• Audit all existing .linkr manifests in use for unauthorized modifications
• Verify the integrity of any recently extracted Linkr packages
• Restrict Linkr usage to manifests from trusted sources only until patching is complete

Patch Information

The vulnerability is addressed in Linkr version 2.0.1, which adds manifest integrity verification. The patch compares the checksum of the original author-created manifest against the one being extracted, aborting the operation on mismatch. Additionally, the system now warns users if no original manifest is hosted for verification.

For detailed patch information, refer to the GitHub Security Advisory GHSA-6wph-mpv2-29xv and the security commit.

Workarounds

• Use only trusted .linkr manifests from verified sources
• Manually verify manifest integrity before extraction by comparing file hashes
• Host manifests exclusively on trusted, access-controlled servers
• Implement additional network-level controls to restrict download sources during Linkr operations

# Verify manifest integrity before extraction (manual workaround)
# Calculate SHA256 hash of the original manifest and compare before use
sha256sum original_manifest.linkr > manifest_hash.txt
sha256sum downloaded_manifest.linkr | diff - manifest_hash.txt