Path traversal in php-spx (CVE-2024-42007)

php-spx is a PHP profiler triggered from the browser. Its 0.4.15 version has a path traversal (CVE-2024-42007) in the endpoint that serves its assets: the parameter naming which file to load is not normalized, so with ../ you escape the assets directory and read any file the web-server user can read (LFI / path traversal).

curl 'http://<ip>/?SPX_KEY=dev&SPX_UI_URI=/../../../../../../etc/passwd'

The real value isn't /etc/passwd but the application files: the site's index.php or config.php usually contain credentials or user hashes (secrets in source) that are later cracked (hash cracking) and reused to authenticate or upload a webshell (file upload to RCE).

Nuances. php-spx only responds if the profiler is enabled and its access key (SPX_KEY) is known or guessed, often dev in test deployments; it should never be exposed in production. The traversal reads, it doesn't execute: it is a first link to chain with the app's logic, not an RCE by itself.

How to detect it. The signature is in the parameter itself: requests with SPX_KEY= and SPX_UI_URI=/../ (or %2e%2e%2f) in the access log, pointing to paths outside the assets directory (/etc/passwd, config.php). The profiler endpoint responding in production is already anomalous, since it should not be exposed; one source walking several ../ paths of varying depth confirms the traversal. Any WAF flags the encoded sequence.

Defence. Update php-spx; never leave the profiler reachable from the Internet (restrict by IP or disable it outside development); and normalize/validate server-side any path coming from a parameter before opening the file.