New Vulnerability module for CVE_2025_55169 ( WeGIA - Directory Traversal )

[Aarush289]

Proposed change
This PR adds a new vulnerability detection module for CVE-2025-55169, affecting WeGIA versions prior to 3.4.8.
The vulnerability is a directory traversal (LFI) issue in the download_remessa.php endpoint, which allows an unauthenticated attacker to read arbitrary files on the server, including sensitive configuration files such as config.php containing database credentials.

The module performs an HTTP GET request with a crafted path traversal payload and determines vulnerability based on the presence of sensitive configuration markers in the response.

Type of change

• New module / payload addition

Checklist

• I’ve followed the contributing guidelines
• I’ve run make pre-commit and it didn’t generate any changes
• I’ve run make test and all tests passed locally

Additional notes

• References to NVD and the official WeGIA GitHub security advisory are included for verification
• The module follows existing OWASP Nettacker conventions for naming, severity, and detection logic
• The issue is marked critical due to direct exposure of sensitive local files
• I have attached the screenshot of successful detection of actual vulnerable instance

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds a WeGIA CVE-2025-55169 vulnerability definition for directory traversal through download_remessa.php, targeting arbitrary file reads, and documents the module in the Modules list.

Changes

WeGIA vulnerability module

Layer / File(s)	Summary
Module definition and documentation nettacker/modules/vuln/wegia_cve_2025_55169.yaml, docs/Modules.md	Adds the vulnerability metadata, traversal payload, response checks, HTTP/HTTPS configuration, and corresponding Modules documentation entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: new module

Suggested reviewers: securestep9

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: a new WeGIA vulnerability module for CVE-2025-55169 directory traversal.
Description check	✅ Passed	The description matches the changeset and accurately explains the new CVE-2025-55169 WeGIA detection module.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@docs/Modules.md`:
- Line 165: Update the module list entry for '**wegia_cve_2025_55169_vuln**' to
add the missing space before the dash and correct the product casing to "WeGIA"
(matching the product name) so the line reads with proper spacing and casing;
locate the entry containing '**wegia_cve_2025_55169_vuln**' in the Modules list
and adjust the text around the dash and product name accordingly.

🧹 Nitpick comments (1)

nettacker/modules/vuln/wegia_cve_2025_55169.yaml (1)

33-45: Verify traversal target path matches WeGIA’s default install layout.

The payload assumes ../../../www/html/wegia/config.php. If the advisory/PoC uses a different path (common for /var/www/html/wegia installs), this module could miss vulnerable targets. Please confirm against the advisory and consider trying multiple candidate paths.

💡 Possible multi-path fuzzer variant

-            input_format: "{{schema}}://{target}:{{ports}}/html/socio/sistema/download_remessa.php?file=../../../www/html/wegia/config.php"
+            input_format: "{{schema}}://{target}:{{ports}}/html/socio/sistema/download_remessa.php?file={{file_path}}"
             prefix: ""
             suffix: ""
             interceptors:
             data:
               schema:
                 - "http"
                 - "https"
               ports:
                 - 80
                 - 443
+              file_path:
+                - "../../../config.php"
+                - "../../../www/html/wegia/config.php"
+                - "../../../../config.php"

[Aarush289]

Testing result is :

[Aarush289]

Hi @securestep9 , Can you please review the module whenever possible .

[securestep9]

@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7a607a0910

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Sign the commit before merging

The reviewed commit has no gpgsig header, and git verify-commit cc702b0bf46386fb0d4586a87b4e3414b5fe0655 fails, so merging it would violate the repository requirement that every commit be signed. Recreate this commit with an accepted signing key before merge.

AGENTS.md reference: AGENTS.md:L33-L35

Useful? React with 👍 / 👎.

[Aarush289]

all commits are signed