CVE-2023-7335: EduSoho Path Traversal Vulnerability

CVE-2023-7335 Overview

CVE-2023-7335 is an arbitrary file read vulnerability affecting EduSoho, an open-source online education platform. The vulnerability exists in the classroom-course-statistics export functionality, where a remote, unauthenticated attacker can supply crafted path traversal sequences in the fileNames[] parameter to read arbitrary files from the server filesystem. This includes sensitive application configuration files such as config/parameters.yml that may contain secrets and database credentials.

Critical Impact

Unauthenticated attackers can read sensitive server files including configuration files containing database credentials and application secrets, potentially leading to full system compromise.

Affected Products

• EduSoho versions prior to 22.4.7

Discovery Timeline

• 2026-01-19 - Exploitation evidence observed by the Shadowserver Foundation
• 2026-01-22 - CVE CVE-2023-7335 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2023-7335

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) allows remote, unauthenticated attackers to read arbitrary files from affected EduSoho installations. The vulnerability is network-accessible without requiring any user interaction or authentication, making it particularly dangerous for internet-facing deployments. The primary impact is a complete loss of confidentiality, as attackers can access any file readable by the web server process, while system integrity and availability remain unaffected.

The vulnerability was assigned CNVD-2023-03903 by the China National Vulnerability Database, and exploitation activity has been observed in the wild by the Shadowserver Foundation.

Root Cause

The root cause of CVE-2023-7335 is improper input validation in the classroom-course-statistics export functionality. The application fails to properly sanitize or validate the fileNames[] parameter before using it in file system operations. This allows attackers to inject directory traversal sequences (such as ../) to escape the intended directory and access files elsewhere on the filesystem.

The lack of proper path canonicalization and allowlist-based validation enables attackers to construct malicious file paths that reference sensitive system and application configuration files.

Attack Vector

The attack is executed through the classroom-course-statistics export endpoint. An attacker sends a crafted HTTP request containing path traversal sequences in the fileNames[] parameter. By using sequences like ../../../ combined with known file paths, attackers can traverse up from the application directory and access arbitrary files.

A typical exploitation scenario targets the config/parameters.yml file, which in Symfony-based applications (like EduSoho) often contains sensitive configuration data including:

• Database connection strings and credentials
• Application secret keys
• Third-party API keys and tokens
• Email server credentials

The vulnerability requires no authentication, meaning any attacker who can reach the vulnerable endpoint over the network can exploit it. For detailed technical information, refer to the VulnCheck Advisory and the CNVD-2023-03903 Details.

Detection Methods for CVE-2023-7335

Indicators of Compromise

• HTTP requests to classroom-course-statistics endpoints containing ../ sequences in the fileNames[] parameter
• Unusual access patterns targeting export functionality from external IP addresses
• Web server logs showing requests with URL-encoded path traversal sequences (%2e%2e%2f)
• Access attempts targeting known sensitive files like config/parameters.yml, /etc/passwd, or similar system files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in the fileNames[] parameter
• Configure intrusion detection systems (IDS) to alert on requests with multiple directory traversal sequences
• Monitor application logs for failed file access attempts outside expected directories
• Deploy SentinelOne Singularity to detect file access anomalies and unauthorized reading of sensitive configuration files

Monitoring Recommendations

• Enable detailed logging for the classroom-course-statistics export functionality
• Set up alerts for any access to config/parameters.yml or other sensitive configuration files from web processes
• Monitor for unusual outbound data transfers that could indicate exfiltration of stolen credentials
• Review access logs regularly for requests containing encoded or unencoded traversal sequences

How to Mitigate CVE-2023-7335

Immediate Actions Required

• Upgrade EduSoho to version 22.4.7 or later immediately
• If immediate patching is not possible, restrict network access to the affected endpoints
• Rotate all credentials stored in configuration files (database passwords, API keys, application secrets)
• Review server logs for evidence of prior exploitation attempts

Patch Information

EduSoho has released version 22.4.7 which addresses this vulnerability. The patched version is available from the official GitHub releases page. Organizations should prioritize upgrading to this version or later to remediate the vulnerability.

Workarounds

• Block external access to the classroom-course-statistics export endpoints at the web server or firewall level
• Implement a reverse proxy or WAF rule to filter requests containing path traversal sequences targeting the fileNames[] parameter
• Restrict the web server process permissions to limit accessible files using chroot or similar isolation techniques
• If the classroom course statistics export feature is not required, consider disabling the affected endpoint entirely

# Example nginx configuration to block path traversal attempts
location ~ /classroom.*course-statistics {
    # Block requests with path traversal sequences
    if ($args ~* "fileNames.*\.\.") {
        return 403;
    }
    # Restrict access to internal network only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}