ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability

The impact of CVE-2025-6445 is significant, allowing a remote attacker to execute arbitrary code on a vulnerable system. Successful exploitation could lead to complete system compromise, data exfiltration, and potential lateral movement within the network. The attack vector involves crafting malicious requests that leverage the directory traversal vulnerability in the FindType method. This could be integrated into web applications utilizing ServiceStack, potentially impacting a wide range of services and data. The ability to execute arbitrary code grants the attacker near-unrestricted control over the affected server.

Applications built using ServiceStack versions 8.4.0 through 8.4.0 are at direct risk. Specifically, systems where ServiceStack is deployed in environments with limited network segmentation or where user input is not properly sanitized are particularly vulnerable. Shared hosting environments utilizing ServiceStack are also at increased risk due to the potential for cross-tenant exploitation.

• .NET / dotnet: Use Sysinternals Process Monitor to observe file access attempts by ServiceStack processes, specifically looking for attempts to access unexpected or unauthorized file paths. • .NET / dotnet: Examine ServiceStack application logs for unusual error messages or exceptions related to file access or path manipulation. • .NET / dotnet: Review application code for instances where user-supplied input is directly used in file path construction without proper validation. • .NET / dotnet: Use a debugger to step through the FindType method and observe the values of user-supplied parameters to identify potential malicious input.

1. 2025-06-25Disclosure

   disclosure

1. Reserviert2025-06-20
2. Veröffentlicht2025-06-25
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6445 is to upgrade ServiceStack to version 8.06 or later, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the FindType functionality or implementing strict input validation on any user-supplied paths used within the method. Web Application Firewalls (WAFs) configured to detect and block directory traversal attempts can also provide a layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to trigger the FindType method with a malicious path; it should now be properly sanitized and rejected.