CVE-2025-63414: Allskyteam Allsky RCE Vulnerability

CVE-2025-63414 Overview

A critical Path Traversal vulnerability exists in the Allsky WebUI version v2024.12.06_06 that allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).

Critical Impact

This vulnerability allows unauthenticated remote attackers to gain complete control of systems running the vulnerable Allsky WebUI software through arbitrary command execution with no user interaction required.

Affected Products

• Allskyteam Allsky WebUI version 2024.12.06_06
• Allsky all-sky camera management software with exposed WebUI

Discovery Timeline

• 2025-12-16 - CVE-2025-63414 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-63414

Vulnerability Analysis

This vulnerability combines path traversal (CWE-22) with command injection to achieve remote code execution. The Allsky WebUI is designed to manage all-sky cameras for astrophotography, and the vulnerable execute.php endpoint fails to properly validate and sanitize the id parameter before processing. This allows an attacker to traverse outside the intended directory structure and inject operating system commands that execute with the privileges of the web server process.

The attack requires no authentication, making it particularly dangerous for internet-exposed Allsky installations. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable component's security scope, potentially allowing lateral movement to other systems on the network.

Root Cause

The root cause of this vulnerability is insufficient input validation in the /html/execute.php script. The id parameter is passed to system functions without proper sanitization, allowing attackers to escape the intended path context and inject arbitrary commands. The application fails to implement proper path canonicalization and does not validate that user-supplied input stays within expected boundaries.

Attack Vector

The attack is conducted remotely over the network with no authentication required. An attacker sends a specially crafted HTTP request to the /html/execute.php endpoint containing directory traversal sequences (such as ../) combined with command injection payloads in the id parameter. The vulnerable endpoint processes this input directly, allowing the attacker to break out of the intended directory context and execute arbitrary shell commands.

The attack flow involves:

1. Identifying an exposed Allsky WebUI instance
2. Crafting a malicious HTTP request targeting /html/execute.php
3. Injecting path traversal sequences and command payloads in the id parameter
4. Achieving arbitrary command execution on the target system

For technical implementation details, refer to the CVE-2025-63414 Analysis and the vulnerable execute.php source code.

Detection Methods for CVE-2025-63414

Indicators of Compromise

• HTTP requests to /html/execute.php containing path traversal sequences (../, ..%2f, etc.) in the id parameter
• Unusual command execution patterns or spawned processes from the web server user account
• Web server logs showing requests with shell metacharacters or command injection syntax in query parameters
• Unexpected network connections or reverse shell activity originating from the Allsky host

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in requests to /html/execute.php
• Monitor web server access logs for suspicious requests containing ../ sequences, URL-encoded variants, or shell command syntax
• Deploy endpoint detection to identify anomalous child processes spawned by the web server process (e.g., unexpected sh, bash, nc, or curl executions)
• Use network intrusion detection systems to alert on command-and-control traffic patterns from Allsky server hosts

Monitoring Recommendations

• Enable detailed logging for the Allsky WebUI and monitor for requests to execute.php with unusual parameter values
• Configure alerts for any process execution initiated by the web server user outside of expected Allsky application behavior
• Monitor outbound network connections from the Allsky host for signs of reverse shell establishment or data exfiltration
• Implement file integrity monitoring on the Allsky WebUI directory to detect unauthorized modifications

How to Mitigate CVE-2025-63414

Immediate Actions Required

• Immediately restrict network access to the Allsky WebUI to trusted IP addresses only using firewall rules
• Disable or remove public internet exposure of the Allsky WebUI until a patch is applied
• Review web server and system logs for any evidence of exploitation attempts or successful compromise
• Consider temporarily disabling the execute.php endpoint if it is not critical for operations

Patch Information

Check the official Allsky GitHub repository for updated releases that address this vulnerability. At the time of publication, users should verify whether a patched version newer than v2024.12.06_06 is available. Review the project's security advisories and release notes for specific remediation guidance.

Workarounds

• Implement network-level access controls to limit WebUI access to trusted internal networks or VPN-connected users only
• Deploy a reverse proxy with WAF capabilities to filter malicious requests targeting the /html/execute.php endpoint
• If feasible, modify file permissions to restrict the web server's ability to execute system commands
• Run the Allsky WebUI in an isolated container or virtual machine to limit the impact of potential compromise

# Example: Restrict access to Allsky WebUI using iptables
# Allow only trusted IP range to access the web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Example: Block access to execute.php using Apache .htaccess
# Add to /html/.htaccess
<Files "execute.php">
    Require ip 192.168.1.0/24
</Files>