CVE-2025-0520: ShowDoc Critical RCE Exploited in the Wild — Detection and Response

---
title: ShowDoc Potential Webshell Activity - Linux Web Server Spawning Shell
id: 8c4d2e1f-9a3b-4c5d-8e6f-7a8b9c0d1e2f
status: experimental
description: Detects potential webshell activity by identifying the web server process (nginx/apache/httpd/php-fpm) spawning a shell (sh, bash, perl, python).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-0520
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/perl'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate administrative scripts executed by the web server (rare)
level: critical
---
title: ShowDoc Suspicious File Creation in Upload Directories
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of script files (.php, .phtml) within common ShowDoc upload paths, indicative of unrestricted file upload exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-0520
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/public/upload/'
      - '/server/public/'
      - '/showdoc/'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
  condition: selection
falsepositives:
  - Legitimate file uploads if the application allows php uploads (unlikely)
level: high

// Hunt for ShowDoc webshell activity: Web server process spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~("nginx", "apache2", "httpd", "php-fpm")
| where FileName in~("sh", "bash", "dash", "perl", "python3", "python")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for suspicious PHP processes spawned by web server users
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'php.*'
  AND Username =~ 'www-data|nginx|apache'
  AND CommandLine !~ 'fpm'

-- Hunt for recently created PHP files in ShowDoc directories
SELECT FullPath, Size, Mtime, Mode.BitsString
FROM glob(globs='/var/www/html/showdoc/**/*.php', root='/')
WHERE Mtime > now() - 24h

#!/bin/bash

# ShowDoc CVE-2025-0520 Emergency Response Script
# Usage: sudo ./remediate_showdoc.sh

echo "[*] Starting ShowDoc Hardening for CVE-2025-0520..."

# 1. Identify ShowDoc Installation (Common paths)
SHOWDOC_PATHS=("/var/www/html/showdoc" "/data/showdoc" "/home/wwwroot/showdoc")
TARGET_PATH=""

for path in "${SHOWDOC_PATHS[@]}"; do
    if [ -d "$path" ]; then
        TARGET_PATH="$path"
        break
    fi
done

if [ -z "$TARGET_PATH" ]; then
    echo "[!] ShowDoc installation directory not found in standard locations. Please manually update the application."
    exit 1
fi

echo "[+] Found ShowDoc at: $TARGET_PATH"

# 2. Check for common Webshell IOCs in upload directories
echo "[*] Scanning for suspicious PHP files in upload directories..."
find "$TARGET_PATH" -type f -name "*.php" -path "*/upload*" -exec ls -la {} \; > /tmp/showdoc_scan.log

if [ -s /tmp/showdoc_scan.log ]; then
    echo "[!] WARNING: Potentially suspicious PHP files found in upload directories. Check /tmp/showdoc_scan.log"
else
    echo "[+] No obvious webshells found in upload folders."
fi

# 3. Enforce permissions on upload directories (Disable execution)
# Note: Adjust the specific upload folder name based on your version structure
UPLOAD_DIR="$TARGET_PATH/public/uploads"
if [ -d "$UPLOAD_DIR" ]; then
    echo "[*] Hardening $UPLOAD_DIR to prevent script execution..."
    chmod -R 755 "$UPLOAD_DIR"
    # Create .htaccess to deny execution if using Apache
    echo "Options -ExecCGI" > "$UPLOAD_DIR/.htaccess"
    echo "AddHandler cgi-script .php .php3 .php4 .php5 .phtml" >> "$UPLOAD_DIR/.htaccess"
    echo "<FilesMatch \"\.(php|php3|php4|php5|phtml)$\">">> "$UPLOAD_DIR/.htaccess"
    echo "  Order Allow,Deny">> "$UPLOAD_DIR/.htaccess"
    echo "  Deny from all">> "$UPLOAD_DIR/.htaccess"
    echo "</FilesMatch>" >> "$UPLOAD_DIR/.htaccess"
    echo "[+] .htaccess restrictions applied."
fi

# 4. Web Server Restart (Optional, to ensure config reloads)
echo "[*] Restarting Web Server (Apache/Nginx)..."
if command -v systemctl &> /dev/null; then
    systemctl restart apache2 2>/dev/null || systemctl restart httpd 2>/dev/null || systemctl restart nginx 2>/dev/null
fi

echo "[+] Remediation steps completed."
echo "[CRITICAL] Please download and apply the official vendor patch for CVE-2025-0520 immediately."