Document Control

Contents

1. Executive Summary

Assessment outcome

Testing against devarea.htb identified one critical unauthenticated vulnerability that chains into two high-severity findings and a high-severity local privilege escalation to root. Full host compromise was achieved from an unauthenticated starting position.

Anonymous FTP access exposed an Apache CXF service JAR. CVE-2022-46364 (CVSS 9.8) allowed unauthenticated server-side request forgery via the MTOM XOP:Include mechanism, enabling arbitrary file read on the server. The Hoverfly systemd service file was read, disclosing administrator credentials stored in plaintext on the command line.

With the recovered credentials, CVE-2025-54123 authenticated remote code execution on Hoverfly v1.11.3 produced an interactive shell as dev_ryan. Privilege escalation was achieved by replacing the world-writable /usr/bin/bash binary with a SUID-dropping script, then triggering the script by invoking a sudo-permitted administration script that called /usr/bin/bash internally.

Impact

The complete compromise chain moved from no credentials to a root shell in four steps. An attacker in the same position could read all files on the host, modify system configuration, establish persistence, and use the host as a pivot point into any connected network.

Priority recommendations

1. Apply the Apache CXF patch for CVE-2022-46364 and restrict SSRF-capable endpoints from making outbound requests.
2. Remove credentials from systemd service files and any process command lines; use a secrets manager or environment file with restricted permissions instead.
3. Apply the Hoverfly patch for CVE-2025-54123 and restrict the Hoverfly admin interface to authorised addresses.
4. Correct the permissions on /usr/bin/bash and audit all binaries called by privileged scripts for unauthorised write access.

Conclusion

Each finding represents an independent control failure. F-01 enables credential recovery, but F-02 (plaintext storage) is the root cause of that exposure. F-03 and F-04 should be remediated regardless of F-01 and F-02 status.

2. Assessment Scope and Methodology

2.1 Target and observed services

nmap -sC -sV -p- <TARGET_IP>

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Sep 22  2025 pub
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp   open  http    Apache httpd 2.4.58
8080/tcp open  http    Jetty 9.4.27.v20200227
8500/tcp open  http    Golang net/http server (proxy)
8888/tcp open  http    Golang net/http server
|_http-title: Hoverfly Dashboard

2.2 Approach

Testing started with full-port service discovery. Anonymous FTP was enumerated first, producing the CXF JAR. The JAR was decompiled to identify the CXF version and WSDL endpoint. SSRF was used to read internal files and recover credentials. Hoverfly was fingerprinted for CVE applicability and the RCE was confirmed before triggering the reverse shell. Post-exploitation enumeration with LinPEAS identified the sudo rule and the world-writable binary.

2.3 Severity classification

3. Results Overview

3.1 Findings summary

3.2 Compromise sequence

3.3 Relationship between findings

F-01 is required to read the service file that contains the credentials described in F-02. F-03 depends on those credentials. F-04 is independent of F-01 through F-03: any user with shell access who discovers the world-writable binary and the sudo rule can escalate to root without involving Hoverfly or the SSRF path.

5. Remediation and Assessment Closeout

5.1 Corrective action plan

No remediation retest is documented. Each finding includes verification criteria for closure.

5.2 Test artefacts

5.3 Evidence and limitations

Evidence blocks are sourced from the DevArea assessment walkthrough. Flag values and cracked passwords are omitted from all evidence. The assessment did not verify all FTP contents or examine all running services.

5.4 Evidence index