Executive Summary

This vulnerability is a Relative Path Traversal issue in the Apache Ignite REST API. Authenticated users of the REST API can exploit the "cmd=log" command by crafting a specific log path that allows them to read any file on the server.

It affects Apache Ignite versions from 2.0.0 through 2.17.0, and the issue is fixed in version 2.18.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated REST API user to read arbitrary files on the server. This could lead to unauthorized disclosure of sensitive information stored on the server, potentially exposing configuration files, credentials, or other critical data.

Useful 0 Not Useful 0

Mitigation Strategies

Users are recommended to upgrade Apache Ignite to version 2.18.0, which fixes the Relative Path Traversal vulnerability in the REST API.

Useful 0 Not Useful 0

Detection Guidance

Detection of the CVE-2025-48977 vulnerability involves checking for attempts to exploit the relative path traversal flaw in the Apache Ignite REST API. Specifically, monitoring for REST API requests using the "cmd=log" command with crafted log path parameters containing traversal patterns like "../" or "../../" can indicate exploitation attempts.

You can detect such attempts by inspecting web server or application logs for suspicious REST API calls that include these traversal sequences.

Example commands to search logs for potential exploitation attempts include:

• Using grep to find traversal patterns in logs: grep -E 'cmd=log.*(\.\./|\.\.\/\.\./)' /path/to/ignite/logs/access.log
• Using grep to find REST API calls with cmd=log: grep 'cmd=log' /path/to/ignite/logs/access.log

Additionally, monitoring network traffic for HTTP requests to the Ignite REST API endpoint containing these patterns can help detect exploitation attempts.

Useful 0 Not Useful 0