Executive brief
RIPS Scanner, a tool used to automatically find security flaws in PHP code, contains a vulnerability that allows unauthorized users to view files on the host server. By sending a specially crafted web request, an attacker can bypass security restrictions to read sensitive system files like configuration data or passwords. This could lead to a full compromise of the server or the exposure of proprietary source code being analyzed by the tool.
Technical details
A path traversal vulnerability (CWE-22) exists in RIPS Scanner version 0.54 due to insufficient sanitization of the 'file' GET parameter in the 'windows/code.php' and 'windows/function.php' scripts. An unauthenticated remote attacker can exploit this by sending a crafted HTTP GET request containing directory traversal sequences (e.g., '../../'). This allows the attacker to read any file on the filesystem that the web server process has permissions to access, such as /etc/passwd or application configuration files. The vulnerability is easily exploitable and has public Metasploit modules available. No official patch is available as development of the 0.5 branch was abandoned in 2013; users are advised to restrict network access to the tool or migrate to newer versions.
Affected products
- RIPS Technologies RIPS Scanner 0.54
Timeline
- 2012-03-24: disclosed: Initial public disclosure and Exploit-DB publication
- 2015-03-01: advisory: Detailed code review published by security researchers
- 2025-07-16: advisory: CVE-2025-34126 assigned and published
References
- https://codesec.blogspot.com/2015/03/rips-scanner-v-054-local-file-include.html
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/rips_traversal.rb
- https://rips-scanner.sourceforge.net/
- https://www.exploit-db.com/exploits/18660
- https://www.vulncheck.com/advisories/rips-scanner-path-traversal