CVE-2025-34300

What it actually does

CVE-2025-34300 is an unauthenticated template injection vulnerability in Sawtooth Software Lighthouse Studio versions prior to 9.16.14, exposed through the ciwweb.pl Perl web application. Because attacker-controlled input can be interpreted as template logic, a remote network attacker can cause the application to execute arbitrary operating-system commands in the security context of the web server process. Successful exploitation can result in full compromise of the Lighthouse Studio application host, including command execution, file read/write access, credential theft, web shell deployment, lateral movement staging, and disruption of survey or research operations.

Why it matters to the business

An exposed vulnerable Lighthouse Studio deployment can be taken over remotely without credentials, which may allow attackers to steal survey data, manipulate research projects, disrupt hosted surveys, pivot into connected systems, or use the server as a foothold for broader compromise. The risk is elevated because exploitation is reported as weaponized and the EPSS probability is high at 0.5108, despite the issue not currently appearing in the CISA KEV catalog. Organizations using internet-facing Lighthouse Studio should treat this as urgent, especially because the vulnerability has been public for an extended period.

How an attack unfolds

An attacker first identifies a Lighthouse Studio instance exposing the ciwweb.pl Perl application, commonly by scanning for the CGI endpoint or fingerprinting Lighthouse Studio survey URLs. The attacker then sends a crafted unauthenticated HTTP request containing template syntax or template-controlled input that the application evaluates unsafely. When the vulnerable template engine processes the request, the injected expression escapes intended template handling and invokes operating-system commands. The attacker typically validates execution with a low-noise command, then escalates activity by retrieving environment details, writing a web shell or script, downloading tooling, accessing survey/application files, harvesting credentials or configuration secrets, and attempting persistence or lateral movement. Because weaponized exploitation is available, defenders should assume exposed unpatched systems may be probed or exploited opportunistically.

How to fix it

Upgrade Sawtooth Software Lighthouse Studio to version 9.16.14 or later. Prioritize any deployment where ciwweb.pl is reachable from the internet or untrusted networks. If immediate upgrade is not possible, restrict access to Lighthouse Studio and ciwweb.pl using network allowlists, VPN-only access, reverse-proxy authentication, or firewall rules; disable or remove unused CGI/script endpoints; and block direct public access to the vulnerable Perl web application. Review the web server service account permissions and reduce write and execution privileges where feasible. After patching, rotate credentials or secrets stored on or accessible from the affected server if exploitation cannot be confidently ruled out.

How to confirm the fix worked

Confirm the installed Lighthouse Studio version is 9.16.14 or later. Verify that ciwweb.pl is no longer vulnerable by using an approved vulnerability scanner or vendor-recommended validation method rather than live exploit payloads. From an external network perspective, confirm that ciwweb.pl is not reachable unless explicitly required and access-controlled. Review web server routing, CGI handler configuration, and reverse-proxy rules to ensure old vulnerable copies of ciwweb.pl are not still exposed in alternate directories, backups, or legacy virtual hosts. Validate that file permissions prevent the web server process from writing executable content into web-accessible directories.

Typical attack path

1. Scan the internet or target network for Lighthouse Studio deployments exposing ciwweb.pl.
2. Confirm the vulnerable endpoint responds without authentication.
3. Send a crafted HTTP request that injects executable template logic into ciwweb.pl input.
4. Trigger server-side evaluation of the injected template content.
5. Execute operating-system commands as the web server or application service account.
6. Run discovery commands to identify user context, filesystem layout, installed tools, and network access.
7. Download or write a web shell, reverse shell, or secondary payload if outbound connectivity is available.
8. Access Lighthouse Studio project files, survey data, credentials, or configuration files.
9. Use the compromised host for persistence, data theft, disruption, or lateral movement.

How to detect it

Review HTTP access logs, error logs, reverse-proxy logs, WAF logs, CGI logs, and EDR process telemetry for suspicious requests to ciwweb.pl followed by operating-system command execution by the web server process. Focus on unauthenticated requests containing encoded characters, shell metacharacters, template-like expressions, command names, outbound download utilities, or attempts to write files into web-accessible directories. Correlate ciwweb.pl requests with child processes spawned by Perl, CGI handlers, web server workers, or application service accounts, especially processes such as sh, bash, cmd.exe, powershell, curl, wget, perl, python, nc, ncat, certutil, or bitsadmin. Examine file creation timestamps around suspicious requests for web shells, new scripts, modified templates, archive files, or binaries in Lighthouse Studio, CGI, temporary, and web root directories. Investigate outbound network connections from the Lighthouse Studio host shortly after ciwweb.pl requests, particularly to unfamiliar IPs, newly registered domains, paste sites, file-sharing services, or command-and-control infrastructure. If logging is limited, perform host triage for persistence artifacts, new users, modified scheduled tasks or cron jobs, anomalous service entries, and credentials accessed after the first suspicious request.

• /ciwweb.pl
• GET /ciwweb.pl
• POST /ciwweb.pl
• ciwweb.pl?
• ciwweb.pl%3F
• /ciwweb.pl?
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell -enc
• powershell.exe -enc
• wget http
• curl http
• curl -o
• wget -O
• nc -e
• ncat -e
• bash -i
• sh -i
• python -c
• perl -e
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• whoami
• id;
• uname -a
• cat /etc/passwd
• certutil -urlcache
• bitsadmin /transfer
• %3Bwhoami
• %7Cwhoami
• %26whoami
• %60whoami%60

What your security team should do

• Identify all Lighthouse Studio installations, including research, survey, test, staging, and third-party-hosted instances.
• Immediately upgrade all instances prior to 9.16.14 to version 9.16.14 or later.
• Prioritize internet-facing systems because the vulnerability is unauthenticated, remotely exploitable, weaponized, and has a high EPSS score.
• If patching is delayed, block public access to ciwweb.pl and require VPN, allowlisted source IPs, or authenticated reverse-proxy access.
• Hunt for prior exploitation in web server logs, CGI logs, EDR telemetry, shell history, process execution events, and suspicious files created by the web server account.
• Review the host for web shells, unexpected Perl/PHP/script files, cron jobs, startup entries, unauthorized accounts, and outbound connections to unknown infrastructure.
• Rotate credentials, API keys, database passwords, and service account secrets accessible from the Lighthouse Studio server if compromise is suspected.
• Add SIEM detections for requests to ciwweb.pl containing shell metacharacters, encoded command strings, or signs of command execution.
• Restrict the web server service account to least privilege and prevent it from writing to executable web directories where possible.
• Monitor vendor advisories for additional fixed versions, exploit details, or post-release hardening guidance.