EUVD-2025-18986
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1.
Analysis
SysmonElixir versions prior to 1.0.1 contain a path traversal vulnerability in the /read endpoint that allows unauthenticated remote attackers to read arbitrary files from the server, including sensitive system files like /etc/passwd. The vulnerability was patched in version 1.0.1 by implementing a whitelist restricting file reads to the priv/data directory. This is a high-severity information disclosure issue (CVSS 7.5) with no authentication required and network-accessible attack surface.
Technical Context
SysmonElixir is an HTTP-based system monitoring service written in Elixir (functional programming language running on the Erlang VM). The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'), where user-supplied input to the /read endpoint is not properly validated before being passed to file system operations. The application fails to canonicalize or sanitize file paths, allowing attackers to use directory traversal sequences (e.g., ../, ../../) to escape intended directory boundaries and access arbitrary files readable by the service process. The patch introduced a whitelist-based approach that restricts all file operations to a controlled priv/data directory, implementing positive security controls rather than relying on blacklists.
Affected Products
- product: SysmonElixir; affected_versions: < 1.0.1; patched_version: 1.0.1 and later; affected_endpoints: /read endpoint; attack_vector: HTTP GET/POST requests with path traversal payloads
Remediation
- priority: CRITICAL; action: Upgrade SysmonElixir to version 1.0.1 or later immediately; implementation: Update dependency in mix.exs to {:sysmon_elixir, "~> 1.0.1"} or newer, then run 'mix deps.update sysmon_elixir' and redeploy - priority: HIGH; action: If immediate patching is not possible, implement network-level mitigations; implementation: ['Restrict network access to the SysmonElixir HTTP service using firewall rules (allow only trusted internal IPs)', 'Deploy a reverse proxy (nginx/Apache) with request filtering to block /read endpoint requests or validate path parameters', 'Run the service with minimal file system permissions (dedicated user with read-only access to priv/data only)'] - priority: MEDIUM; action: Post-remediation verification; implementation: ['Audit logs for suspicious /read requests with path traversal patterns (../, etc.)', 'Scan systems for potential unauthorized file access or information disclosure', 'Review service process permissions and file system access controls']
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today