Listen to this Post
How the CVE Works
CVE-2025-44177 exploits a directory traversal vulnerability in White Star Software Protop version 4.4.2-2024-11-27. The flaw resides in the `/pt3upd/` endpoint, which fails to properly sanitize user-supplied input. An attacker can send crafted HTTP requests containing encoded traversal sequences (e.g., `../` or URL-encoded variants) to bypass security restrictions. This allows unauthorized access to arbitrary files on the underlying operating system, including sensitive configuration files, credentials, or system data. The attack is remotely executable without authentication, making it highly exploitable.
DailyCVE Form
Platform: White Star Software Protop
Version: 4.4.2-2024-11-27
Vulnerability: Directory Traversal
Severity: Critical
Date: 07/18/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
curl -X GET "http://target/pt3upd/..%2F..%2Fetc/passwd" grep -r "vulnerable_endpoint" /var/log/protop.log
How Exploit
1. Craft HTTP request with traversal sequences.
2. Target `/pt3upd/` endpoint.
3. Retrieve sensitive files (e.g., `/etc/shadow`).
Protection from this CVE
- Apply vendor patch.
- Restrict `/pt3upd/` endpoint.
- Implement input validation.
Impact
- Unauthorized file access.
- Potential system compromise.
- Data exfiltration.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
