Verschillende problemen in BBOT's `unarchive.py` kunnen leiden tot willekeurig bestand schrijven en RCE

The primary impact of CVE-2025-10284 is Remote Code Execution. An attacker controlling a malicious website can exploit this vulnerability by crafting a specific request that triggers the unarchive.py script to write files outside of its intended directory. This allows the attacker to execute arbitrary code on the user's system, effectively gaining control. The blast radius extends to any user who utilizes bbot to scan websites, particularly if they are unaware of the malicious nature of the target site. This vulnerability shares similarities with other file manipulation vulnerabilities where improper input validation leads to arbitrary file writes and subsequent code execution.

Users who rely on bbot for website scanning, particularly those who frequently scan websites from untrusted sources, are at significant risk. Individuals using older, unpatched versions of bbot (≤2.6.1.6915rc0) are especially vulnerable. Those running bbot in automated environments or as part of a CI/CD pipeline are also at increased risk.

• python / supply-chain:

import os
import subprocess

# Check for bbot version
result = subprocess.run(['bbot', '--version'], capture_output=True, text=True)
version = result.stdout.strip()
if version.startswith('2.6.'):  # Check for affected versions
    print("BBot version is vulnerable to CVE-2025-10284")

• linux / server:

# Check for suspicious file creation in /tmp or other writable directories
find /tmp -type f -mmin -60 -print

• generic web: Inspect HTTP requests to unarchive.py for unusual parameters or file extensions.

1. 2025-10-09Disclosure

   disclosure

1. Gereserveerd2025-09-11
2. Gepubliceerd2025-10-09
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-10284 is to upgrade bbot to version 2.7.0 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider temporarily disabling the unarchive.py script if it's not essential to your workflow. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to inspect requests to unarchive.py for suspicious patterns. Monitor system logs for unusual file creation activity, particularly in unexpected locations. After upgrading, confirm the fix by attempting to scan a known safe website and verifying that no unexpected files are created.