Zip Slip in Google SecOps SOAR allows for Remote Code Execution

The impact of CVE-2025-9918 is significant due to its potential for Remote Code Execution. A successful exploit allows an attacker to execute arbitrary commands on the SecOps SOAR server with the privileges of the user performing the import. This could lead to complete system compromise, including data exfiltration, modification of security configurations, and lateral movement within the network. The attacker's ability to import Use Cases is the primary prerequisite, highlighting the importance of access controls within the SecOps SOAR environment. This vulnerability shares similarities with other path traversal exploits where attackers leverage crafted input to access unauthorized files and execute malicious code.

Organizations heavily reliant on Google SecOps SOAR for security orchestration and automation are at risk. Specifically, environments where multiple users have permissions to import Use Cases, or where access controls are not strictly enforced, are particularly vulnerable. Shared hosting environments utilizing SecOps SOAR also present a heightened risk due to the potential for cross-tenant exploitation.

• linux / server: Monitor system logs (journalctl) for suspicious process execution following Use Case imports. Specifically, look for processes spawned from the SecOps SOAR server with unexpected command-line arguments.

journalctl -u google-secops-soar -f | grep -i 'path traversal'

• other: Review SecOps SOAR audit logs for any unusual archive import activity or errors related to file access. Examine the server's file system for unexpected files or modifications. • generic web: If SecOps SOAR exposes an API for importing Use Cases, test it with a benign ZIP archive to ensure proper input validation and error handling.

1. 2025-09-11Disclosure

   disclosure

1. Reserviert2025-09-03
2. Veröffentlicht2025-09-11
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-9918 is to upgrade Google SecOps SOAR Server to version 6.3.54.0 or later. If upgrading immediately is not feasible, restrict access to Use Case import functionality to only authorized personnel. Implement strict input validation on all uploaded archives, specifically looking for path traversal sequences (e.g., ../). Consider using a Web Application Firewall (WAF) to filter out malicious ZIP files containing suspicious patterns. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual process execution after archive imports is recommended. After upgrading, confirm the fix by attempting to import a test ZIP archive containing a known path traversal sequence; the import should fail with an appropriate error message.