CVE-2025-13283: Cht Tenderdoctransfer Path Traversal Flaw

CVE-2025-13283 Overview

TenderDocTransfer, developed by Chunghwa Telecom, contains a critical Arbitrary File Copy and Paste vulnerability combined with Cross-Site Request Forgery (CSRF) and Absolute Path Traversal weaknesses. The application establishes a simple local web server and exposes APIs for communication with target websites. Due to insufficient CSRF protection in these APIs, unauthenticated remote attackers can exploit these endpoints through phishing attacks. Furthermore, one of the APIs suffers from an Absolute Path Traversal vulnerability (CWE-36), allowing attackers to copy arbitrary files from the user's system and paste them into any accessible path.

Critical Impact

Remote attackers can leverage phishing techniques to exploit unprotected APIs, enabling arbitrary file copying that may lead to sensitive information disclosure or denial of service through disk space exhaustion.

Affected Products

• CHT TenderDocTransfer (all versions)

Discovery Timeline

• 2025-11-17 - CVE-2025-13283 published to NVD
• 2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-13283

Vulnerability Analysis

This vulnerability represents a dangerous combination of security weaknesses in TenderDocTransfer's local web server architecture. The application exposes local APIs without implementing proper CSRF protections, creating an attack surface that can be exploited remotely through social engineering vectors such as phishing campaigns.

The core issue stems from the application's failure to validate and restrict file path parameters in its API endpoints. An attacker can craft malicious requests that leverage Absolute Path Traversal (CWE-36) to access files outside the intended directory structure. When combined with the lack of CSRF tokens, an attacker can trick authenticated users into executing these malicious file operations simply by visiting a crafted webpage or clicking a malicious link.

The attack requires user interaction (such as clicking a phishing link), but once triggered, the attacker gains the ability to copy sensitive files from anywhere on the victim's system to attacker-controlled locations, or to repeatedly copy large files to consume disk space and degrade system performance.

Root Cause

The root cause of this vulnerability is twofold: first, the absence of CSRF protection mechanisms (such as anti-CSRF tokens or SameSite cookie attributes) on the local web server APIs exposes them to cross-origin requests initiated by malicious websites. Second, the file copy API fails to properly sanitize and validate path parameters, accepting absolute paths that allow traversal outside the application's intended working directory. This combination of CWE-36 (Absolute Path Traversal) with missing CSRF protections creates a remotely exploitable attack chain.

Attack Vector

The attack follows a multi-stage exploitation chain that leverages both the CSRF weakness and the path traversal vulnerability:

1. Phishing Delivery: The attacker sends a phishing email or message containing a link to a malicious webpage
2. CSRF Exploitation: When the victim visits the malicious page while TenderDocTransfer is running, JavaScript on the page makes requests to the local web server APIs
3. Path Traversal Abuse: The malicious requests include crafted path parameters with absolute paths (e.g., C:\Users\victim\Documents\sensitive.doc) to access files outside normal boundaries
4. File Exfiltration or DoS: The attacker either copies sensitive files to accessible locations for later retrieval, or initiates large-scale file copy operations to exhaust disk space

The network-based attack vector combined with the requirement for user interaction (clicking a phishing link) characterizes this as a socially-engineered remote attack that bypasses traditional network perimeter defenses.

Detection Methods for CVE-2025-13283

Indicators of Compromise

• Unexpected network connections to localhost web server ports used by TenderDocTransfer
• Unusual file copy operations involving system directories or sensitive user folders
• Rapid disk space consumption without user-initiated file operations
• Browser-initiated requests to local API endpoints from external domain referrers

Detection Strategies

• Monitor for HTTP requests to TenderDocTransfer's local web server that originate from cross-origin contexts
• Implement file integrity monitoring on sensitive directories to detect unauthorized copy operations
• Review web proxy logs for requests containing path traversal patterns such as absolute Windows paths in API parameters
• Deploy endpoint detection rules to identify TenderDocTransfer API abuse patterns

Monitoring Recommendations

• Enable detailed logging for TenderDocTransfer application activity
• Configure endpoint protection to alert on suspicious file system operations initiated by the application
• Monitor disk space utilization for sudden unexplained increases that may indicate exploitation
• Review browser activity logs for connections to localhost services from untrusted web pages

How to Mitigate CVE-2025-13283

Immediate Actions Required

• Restrict or disable TenderDocTransfer until a patched version is available from Chunghwa Telecom
• Implement network-level controls to prevent cross-origin requests to local web server ports
• Educate users about phishing risks specifically targeting this vulnerability
• Consider application whitelisting to prevent unauthorized API access

Patch Information

Organizations should consult the Taiwan CERT Security Notification for the latest remediation guidance from Chunghwa Telecom. Monitor vendor communications for security updates that address the CSRF and path traversal vulnerabilities.

Workarounds

• Disable TenderDocTransfer when not actively required for document transfer operations
• Configure browser security settings to block scripts from making requests to localhost addresses
• Implement host-based firewall rules to restrict access to the local web server port
• Deploy browser extensions that prevent CSRF attacks against local services

# Example: Windows Firewall rule to block external access to TenderDocTransfer local server
# Adjust port number based on actual application configuration
netsh advfirewall firewall add rule name="Block TenderDocTransfer External" dir=in action=block protocol=tcp localport=<LOCAL_SERVER_PORT> remoteip=any