id: CVE-2025-0994

info:
  name: "Trimble Cityworks - Remote Code Execution"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are
    vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code
    execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-0994&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cityworks&match=exact
  classification:
    cve-id: CVE-2025-0994
  metadata:
    verified: false
  tags: cve,cve2025,kev,cityworks,deserialization,rce
http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/Cityworks/Login.aspx"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Cityworks"

      - type: dsl
        dsl:
          - "compare_versions(version, '<15.8.9')"

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'Cityworks ([0-9.]+) - Revision [0-9.]+'
        internal: true

      - type: kval
        kval:
          - version