CVE-2025-25286: Crayfish allows Remote Code Execution via Homarus Authorization header
Impact Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. Patches The issue has been patched in islandora/crayfish:4.1.0 Workarounds The exploit requires making a request against the Homarus's /convert endpoint;
Published Jan 15, 2025 · Updated Feb 13, 2025
Affected packages
islandora/crayfish
- Ecosystem
- Composer (PHP)
- Affected
- < 4.1.0
- Fixed in
- 4.1.0
- Check
composer show islandora/crayfish
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Remote code execution may be possible in web-accessible installations of Homarus in certain configurations.
Patches
The issue has been patched in islandora/crayfish:4.1.0
Workarounds
The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.
Configure auth in Crayfish to be more strongly required, such that requests with Authorization headers that do not validate are rejected before the problematic CLI interpolation occurs.
References
- XBOW-024-071
Credited to seth-shaw-asu, adam-vessey.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology