Servicestack CVE-2025-6445

The CVSS 3.1 score of 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates: (1) Network-accessible attack vector with no authentication required; (2) High attack complexity suggesting exploitation requires specific conditions or application configurations; (3) High confidentiality, integrity, and availability impact (complete system compromise). The AC:H rating is significant—this is not a trivial remote worm; it requires the application to expose FindType functionality in an exploitable manner. The lack of user interaction (UI:N) and unchanged scope (S:U) confirms this is a direct, in-process code execution. Real-world risk depends heavily on: whether ServiceStack applications expose FindType through public APIs or service methods; whether the application processes untrusted path inputs; and deployment context (internet-facing vs. internal). This is a HIGH priority for ServiceStack operators but with moderate exploitability friction due to AC:H. Organizations must assess their specific ServiceStack configurations to determine exposure.

An attacker identifies a ServiceStack web service application exposing a public API endpoint that accepts a 'typePath' or similar parameter passed to internal FindType method calls. The attacker crafts a request with a malicious path traversal payload (e.g., 'http://target.com/api/service?typeName=../../../../../../Windows/System32/malicious.dll') that, combined with ServiceStack's reflection capabilities, loads and executes arbitrary code. Alternatively, if the application deserializes untrusted JSON or XML that includes path parameters processed by FindType, the attacker can inject traversal sequences in request body. The AC:H rating suggests this requires: (1) the application must expose a code path that passes user input directly to FindType, and (2) the ServiceStack type-loading mechanism must be configured to load from the traversed location. Modern ASP.NET Core deployments with least-privilege file permissions may further limit impact, but older .NET Framework-based ServiceStack applications are higher risk. No public POC data provided in the summary, but ZDI tracking (ZDI-CAN-25837) indicates vendor coordination occurred, suggesting patch availability or imminent release.