CVE-2018-25438: Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the affected Group-Office web endpoint can attempt exploitation. Authentication is not required, and exploitation uses a GET request to /compress.php.
Which deployments are affected?
Intermesh Group-Office versions from 3.3.0 up to, but not including, 3.5.5 are affected. The vulnerable behavior is in compress.php when processing the file parameter.
What access can an attacker gain?
An attacker can read arbitrary files accessible to the web server process by supplying ../ sequences in the file parameter. The described impact includes disclosure of files such as /etc/passwd; integrity and availability impact are not described.
How can I check whether exploitation may have occurred?
Review web-server and application logs for GET requests to /compress.php where the file parameter contains ../ traversal sequences. Such requests are consistent with attempts to cause compress.php to read files outside its cache path.