CVE-2025-13161: IQ-Support Path Traversal Vulnerability

CVE-2025-13161 Overview

CVE-2025-13161 is a relative path traversal vulnerability in IQ-Support, developed by IQ Service International. The flaw allows unauthenticated remote attackers to read arbitrary files from the underlying system by manipulating path traversal sequences in user-supplied input. Successful exploitation discloses sensitive system files, configuration data, and credentials stored on the host. The vulnerability is tracked under CWE-23: Relative Path Traversal and was published by Taiwan Computer Emergency Response Team coordination. No authentication or user interaction is required, and the attack is delivered over the network.

Critical Impact

Unauthenticated remote attackers can download arbitrary files from the IQ-Support host, exposing system configuration, application secrets, and credentials.

Affected Products

• IQ-Support by IQ Service International
• Specific affected versions: Not Available in NVD entry
• Refer to the TWCCERT Security Notification for vendor scope

Discovery Timeline

• 2025-11-14 - CVE-2025-13161 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13161

Vulnerability Analysis

IQ-Support exposes a network-accessible file download function that fails to validate or canonicalize user-supplied path parameters. An unauthenticated attacker can submit relative traversal sequences such as ../ to escape the intended download directory. The application then returns the requested file contents from anywhere on the host filesystem reachable by the service account. The flaw is classified as CWE-23: Relative Path Traversal and falls under the Arbitrary File Read category. Disclosed files commonly include operating system configuration, application source, database connection strings, and any secrets readable by the IQ-Support process.

Root Cause

The root cause is insufficient input validation on path or filename parameters processed by the IQ-Support download handler. The handler concatenates attacker-controlled values directly into a filesystem path without resolving the canonical path or enforcing a strict allow-list of permitted directories. Because no authentication gate sits in front of the affected endpoint, the validation gap is reachable from any network position that can connect to the service.

Attack Vector

The vulnerability is exploited over the network with low attack complexity. An attacker issues a crafted HTTP request to the vulnerable IQ-Support endpoint with a file parameter containing repeated ../ segments followed by a target file path. The server resolves the path outside the intended base directory and returns the file in the response body. Refer to the TWCCERT Incident Report for vendor-published technical details. No verified public exploit code is currently indexed for this CVE.

Detection Methods for CVE-2025-13161

Indicators of Compromise

• HTTP requests to IQ-Support endpoints containing ../, ..%2f, ..%5c, or double-encoded traversal sequences in query strings or POST bodies
• Successful responses returning file content for paths outside the application's expected document root
• Access log entries referencing sensitive paths such as /etc/passwd, /etc/shadow, web.config, or appsettings.json
• Spikes in outbound data transfer from the IQ-Support host immediately following anomalous request patterns

Detection Strategies

• Deploy web application firewall rules that block path traversal patterns in parameters consumed by IQ-Support handlers
• Correlate web server access logs against a list of high-value file paths and alert on any 200 responses tied to traversal payloads
• Hunt for unauthenticated GET or POST requests that contain encoded traversal sequences targeting download or file-serving endpoints

Monitoring Recommendations

• Enable verbose access logging on the IQ-Support web tier and forward logs to a centralized analytics platform for retention and search
• Establish a baseline for normal file request patterns and alert on deviations such as access to system directories
• Monitor process-level file access on the IQ-Support host for reads of sensitive files by the service account outside expected directories

How to Mitigate CVE-2025-13161

Immediate Actions Required

• Restrict network exposure of IQ-Support to trusted management networks until a vendor patch is applied
• Place the application behind a web application firewall configured to block path traversal payloads and encoded variants
• Rotate any credentials, API keys, or certificates that may have been stored on the IQ-Support host and were readable by the service account
• Review web server access logs for traversal attempts and confirm whether sensitive files were successfully retrieved

Patch Information

Consult IQ Service International and the TWCCERT Security Notification for the current fixed version and upgrade instructions. The NVD entry does not list fixed version identifiers at publication. Apply the vendor-supplied update on all IQ-Support instances and verify the fix by replaying known traversal payloads against a non-production environment.

Workarounds

• Enforce a strict allow-list of permitted file paths or identifiers at a reverse proxy in front of IQ-Support
• Run the IQ-Support service under a least-privilege account that cannot read system files, configuration stores, or credentials
• Apply filesystem ACLs that deny the service account read access to directories outside the application's working tree
• Disable or remove the vulnerable download endpoint via reverse proxy rules if it is not required for business operations

# Example reverse proxy rule blocking traversal sequences (nginx)
location /iqsupport/ {
    if ($args ~* "(\.\./|\.\.%2f|\.\.%5c|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://iqsupport_backend;
}