brandonperezlara/cve-2025-67223
Esta falla permite a un atacante remoto y sin ningún tipo de autenticación acceder directamente a los tickets de soporte, casos internos y a todos sus archivos adjuntos confidenciales. Al iterar y descargar de forma automatizada los registros de Aranda, dejando la información sensible expuesta a una exfiltración masiva.
CVE ID: CVE-2025-67223
Affected Product: Aranda Service Desk (Aranda File Server - AFS module)
Affected Versions: < 8.3.12
Author: Brandon Perez Lara
A critical vulnerability was identified in the file management module (Aranda File Server) of Aranda Service Desk. The system stores daily activity logs with predictable names (e.g., YYYYMMDD.log) in a public directory (/AFS/logs/) without any access restrictions.
The risk level of this vulnerability is critical: This flaw allows an unauthenticated remote attacker to iterate and systematically download Aranda's logs in an automated manner. The core issue is that these log files expose the virtual paths of all uploaded files on the system, granting the attacker the ability to indiscriminately view and exfiltrate support tickets, confidential Aranda internal cases, and all associated sensitive file attachments.
The exploitation chain consists of identifying the exposed logs, extracting the internal file paths, and directly accessing the sensitive files.
1 - Log Access: A simple HTTP request is made to the /AFS/logs/ directory referencing the current or a past date (e.g. 20251201.log).
2 - Path Extraction (Information Disclosure): When the log is downloaded, relative paths are exposed such as: SERVICE DESK FILE UPLOADED ServiceCalls\365763\description...html. In addition, error messages in the log reveal absolute server paths (e.g. D:\inetpub\wwwroot\...).
3 - Direct Access (Broken Access Control): Since the system does not validate the user's session for these static resources, the attacker only needs to concatenate the extracted path with the base URL (e.g. /AFS/ServiceDesk/ServiceCalls/...) to access the file.
Exfiltration: Using this method, it is possible to download HTML descriptions of the tickets, as well as sensitive attachments such as PDFs, ZIP files, images, or SQL scripts.
Script CVE-2025-67223.py:
Impact
This vulnerability allows a third party to silently exfiltrate:
Remediation
Aranda Software has issued a patch to address this. The main recommendations implemented are:
Update Aranda Service Desk to version 8.3.12 or higher.
Restrict access to the logs by moving them outside the web root (wwwroot).
Enforce mandatory session validation to access the /ServiceDesk/ServiceCalls/ and /Incidents/ directories.
Disable Directory Listing on the IIS web server.
Cybersecurity is a collaborative effort. I want to thank the development and security teams involved for their response to this report. Keep your systems up to date. 💻🔒
Official References
#Cybersecurity #Pentesting #CVE #Vulnerability #Infosec #EthicalHacking #BugBounty
