CVE-2025-62724 Overview
CVE-2025-62724 is a Time-of-Check to Time-of-Use (TOCTOU) race condition in Open OnDemand, an open-source High Performance Computing (HPC) web portal. Authenticated users can exploit the ZIP file download workflow to access files outside the OOD_ALLOWLIST directories configured in the file browser. The flaw affects all versions prior to 4.0.8 and 3.1.16. Files remain protected by underlying UNIX permissions, which limits the scope of exposure. The issue is tracked under [CWE-61] (UNIX Symbolic Link Following) and carries a medium severity rating.
Critical Impact
Authenticated Open OnDemand users can bypass file browser allowlist restrictions to enumerate or download files outside sanctioned directories, subject to UNIX permission enforcement.
Affected Products
- Open OnDemand versions prior to 3.1.16 (3.x branch)
- Open OnDemand versions prior to 4.0.8 (4.x branch)
- HPC portal deployments relying on OOD_ALLOWLIST file browser restrictions
Discovery Timeline
- 2025-11-20 - CVE-2025-62724 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62724
Vulnerability Analysis
Open OnDemand exposes a file browser that permits users to download directory contents as ZIP archives. The application validates requested paths against the OOD_ALLOWLIST configuration before packaging files. A window exists between the allowlist check and the file read operation. An attacker can manipulate filesystem state during that window to redirect the archiving routine toward files outside the sanctioned paths.
The vulnerability is a classic TOCTOU race condition. The path validation logic and the subsequent file access are not atomic. Users with shell access on the underlying host can swap directory entries or introduce symbolic links between the two operations to escape the allowlist boundary. UNIX discretionary access control still governs whether the served file contents are readable by the OnDemand process, which caps the confidentiality impact.
Root Cause
The root cause is non-atomic path resolution in the ZIP download handler. Open OnDemand resolves and validates the target path, then reopens the path for reading during archive assembly. Because the second lookup does not preserve the identity verified during the first, symlink substitution or directory manipulation subverts the allowlist enforcement.
Attack Vector
An authenticated user issues a ZIP download request for a directory within their allowed scope. The user concurrently modifies the target path on the host filesystem, typically through symlinks pointing to paths outside OOD_ALLOWLIST. Upon the racing file open, the archiver traverses the attacker-controlled link and includes files from outside the sanctioned directories in the resulting ZIP archive.
Exploitation code is not published in the referenced advisory. Refer to the GitHub Security Advisory GHSA-vjpg-34px-gjrw for maintainer-provided technical detail.
Detection Methods for CVE-2025-62724
Indicators of Compromise
- ZIP download requests in Open OnDemand access logs targeting paths that resolve to symbolic links created shortly before the request
- Web server audit trails showing repeated download attempts for the same directory within short intervals, consistent with race-window probing
- Filesystem audit events (auditd) recording symlink() or rename() syscalls under user home directories immediately preceding ZIP handler activity
Detection Strategies
- Correlate Open OnDemand application logs with host-level filesystem auditing to identify races between path validation and file open events
- Alert on ZIP archives whose manifest contents include files residing outside configured OOD_ALLOWLIST roots
- Baseline normal file browser usage per user and flag anomalous burst patterns against the ZIP download endpoint
Monitoring Recommendations
- Enable verbose logging in the Open OnDemand file browser Passenger application and forward logs to a centralized SIEM
- Monitor auditd rules for symlink creation targeting sensitive paths such as /etc, /root, or shared project directories
- Track user-agent, source IP, and request timing patterns for the /pun/sys/files endpoints to detect scripted exploitation
How to Mitigate CVE-2025-62724
Immediate Actions Required
- Upgrade Open OnDemand deployments on the 4.x branch to version 4.0.8 or later
- Upgrade Open OnDemand deployments on the 3.x branch to version 3.1.16 or later
- Audit UNIX permissions on directories referenced by OOD_ALLOWLIST and adjacent sensitive paths to enforce least privilege
- Review recent ZIP download activity for anomalous access patterns preceding the upgrade
Patch Information
The Open OnDemand maintainers released fixed builds in versions 4.0.8 and 3.1.16. Both releases address the TOCTOU condition in the ZIP download handler. Deployment instructions and release notes are available in the GitHub Security Advisory GHSA-vjpg-34px-gjrw.
Workarounds
- Disable the ZIP directory download feature in the Open OnDemand file browser until patches are applied
- Restrict Open OnDemand user accounts to non-shell PAM configurations to reduce filesystem manipulation capability
- Tighten UNIX permissions on files outside OOD_ALLOWLIST so that the OnDemand Per-User NGINX (PUN) process cannot read sensitive data even if the allowlist is bypassed
- Apply mandatory access control policies (SELinux or AppArmor) to constrain the PUN process to allowlisted directories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
