CVE-2018-25408: Open ISES Path Traversal Vulnerability

CVE-2018-25408 Overview

CVE-2018-25408 is a path traversal vulnerability in The Open ISES Project version 3.30A. The flaw resides in the ajax/download.php endpoint, which fails to sanitize the filename parameter. Unauthenticated remote attackers can supply directory traversal sequences such as ../ to read arbitrary files outside the intended download directory. Targeted files include application configuration files, credentials, and operating system files readable by the web server process. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated attackers can retrieve arbitrary files from the server file system over the network, exposing sensitive configuration data and credentials.

Affected Products

The Open ISES Project 3.30A
ajax/download.php endpoint within the OpenISES web application
Deployments that expose the OpenISES interface to untrusted networks

Discovery Timeline

2026-05-30 - CVE-2018-25408 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2018-25408

Vulnerability Analysis

The vulnerability exists in the ajax/download.php script shipped with The Open ISES Project 3.30A. The script accepts a filename parameter from the HTTP request and uses it to construct a file path passed to a file read operation. The endpoint does not validate, canonicalize, or restrict the parameter to a safe base directory. An attacker can submit relative path segments such as ../../../../etc/passwd to escape the intended download folder and read any file accessible to the web server user.

Because the endpoint requires no authentication, exploitation only requires network reachability to the application. The data exposed depends on the host platform and file system permissions. Likely targets include application configuration files containing database credentials, session storage, server logs, and operating system files such as /etc/passwd on Linux or boot.ini on Windows.

Root Cause

The root cause is missing input validation on the filename parameter. The code concatenates user-controlled input into a file path without rejecting traversal sequences, enforcing an allowlist of permitted files, or canonicalizing the resolved path against a base directory. This pattern matches CWE-22.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction. An attacker issues a single HTTP GET request to ajax/download.php with a crafted filename value containing ../ sequences. Public proof-of-concept details are available in Exploit-DB entry 45655 and the VulnCheck advisory.

No verified exploit code is reproduced here. The vulnerability mechanism is straightforward: the server returns the contents of whatever file the resolved path points to, allowing attackers to enumerate and exfiltrate files iteratively.

Detection Methods for CVE-2018-25408

Indicators of Compromise

HTTP requests to ajax/download.php containing ../, ..\, or URL-encoded variants such as %2e%2e%2f in the filename parameter.
Web server access logs showing successful 200 responses to download.php requests referencing system paths such as /etc/passwd, /etc/shadow, or application configuration files.
Unusual outbound traffic volume from the web server in response to repeated download.php requests.

Detection Strategies

Deploy web application firewall rules that block traversal sequences in query string parameters targeting download.php.
Inspect HTTP logs for requests where the filename parameter resolves outside the documented OpenISES content directories.
Correlate sequential file download requests from the same source IP that reference non-OpenISES filenames.

Monitoring Recommendations

Enable verbose access logging on the web server hosting OpenISES and forward logs to a centralized analytics platform.
Alert on any HTTP request to ajax/download.php containing .. regardless of encoding.
Monitor file integrity on configuration files and credential stores accessible to the web server account.

How to Mitigate CVE-2018-25408

Immediate Actions Required

Restrict network access to the OpenISES application using firewall rules or a reverse proxy that requires authentication.
Block requests to ajax/download.php containing traversal sequences at the web application firewall or reverse proxy layer.
Audit the web server account permissions and remove read access to sensitive files that the application does not require.
Review access logs for prior exploitation attempts referencing the filename parameter.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2018-25408. The Open ISES Project is hosted on SourceForge at the project homepage and the latest download page. Operators should verify whether a maintained release addresses the issue or consider replacing the application if no fix is available.

Workarounds

Remove or disable the ajax/download.php endpoint if the file download feature is not required.
Implement a server-side allowlist that maps requested identifiers to fixed file paths rather than accepting raw filenames.
Place the OpenISES application behind an authenticating reverse proxy to eliminate unauthenticated network exposure.
Run the web server under a low-privilege account with read access limited to the OpenISES content directory.

bash

# Example nginx configuration to block traversal sequences targeting download.php
location ~* /ajax/download\.php {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    # Optional: require authentication
    auth_basic "OpenISES";
    auth_basic_user_file /etc/nginx/.htpasswd;
}