CVE-2025-13879: Efficientip Solidserver Path Traversal

CVE-2025-13879 Overview

CVE-2025-13879 is a directory traversal vulnerability [CWE-22] in EfficientIP SOLIDserver IP Address Management (IPAM) version 8.2.3. An authenticated administrator can manipulate the directory parameter in the /mod/ajax.php?action=sections/list/list endpoint to enumerate files outside the intended LOCAL:/// folder. Setting the directory parameter to / exposes the underlying filesystem structure. The flaw requires high privileges and does not directly impact integrity or availability, but it discloses sensitive directory contents that should remain isolated from the IPAM application context.

Critical Impact
Authenticated administrators can traverse the SOLIDserver filesystem and enumerate files outside the application's intended directory scope.

Affected Products

EfficientIP SOLIDserver IP Address Management 8.2.3
Deployments exposing the /mod/ajax.php administrative endpoint
IPAM installations relying on the LOCAL:/// directory abstraction for file isolation

Discovery Timeline

2025-12-02 - CVE-2025-13879 published to NVD
2026-01-30 - Last updated in NVD database

Technical Details for CVE-2025-13879

Vulnerability Analysis

The vulnerability resides in the file listing handler reachable through /mod/ajax.php?action=sections/list/list. The application accepts a user-supplied directory parameter and passes it to the directory enumeration routine without validating that the resolved path remains inside the LOCAL:/// namespace. An authenticated administrator can substitute arbitrary paths, including the root directory /, and receive listings of system folders. The exposure is limited to confidentiality of file and directory names rather than direct content read or write. However, the leaked filesystem layout supports follow-on attacks against the SOLIDserver host, including identification of configuration files, credential stores, and writable paths usable for additional exploitation chains.

Root Cause

The root cause is missing path canonicalization and namespace enforcement on the directory request parameter. The handler treats the LOCAL:/// prefix as a logical hint rather than a strict boundary. When a caller provides a value such as /, ../, or another absolute path, the underlying listing function dereferences it against the host filesystem. This pattern matches [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the SOLIDserver web interface and valid administrator credentials. The attacker issues an authenticated HTTP request to /mod/ajax.php?action=sections/list/list with the directory parameter set to a path outside LOCAL:///. The server responds with a directory listing of the requested location. No user interaction or additional privilege escalation is required beyond the existing administrator session. The flaw is most relevant in scenarios where administrator accounts are shared, federated through SSO, or compromised through credential theft, and where defenders assume the IPAM interface cannot reveal host-level filesystem data.

No verified public proof-of-concept code is available. Refer to the INCIBE CERT Directory Traversal Notice for the official advisory.

Detection Methods for CVE-2025-13879

Indicators of Compromise

HTTP requests to /mod/ajax.php?action=sections/list/list containing directory parameter values that begin with /, .., or any path outside LOCAL:///
Web server access logs showing administrator sessions enumerating multiple non-application directories in short succession
Unexpected response sizes from the sections/list/list action correlating with system path enumeration

Detection Strategies

Inspect SOLIDserver application logs and reverse proxy logs for directory= query strings that resolve outside the LOCAL:/// namespace
Deploy web application firewall rules that decode and normalize the directory parameter, blocking traversal sequences such as ../, encoded variants, and absolute paths
Correlate administrator authentication events with subsequent file listing activity to identify session abuse

Monitoring Recommendations

Forward web access logs and SOLIDserver audit logs to a centralized SIEM for retention and query
Alert on administrator API calls issued from new IP addresses, unusual user agents, or outside change windows
Baseline the volume and target paths of legitimate sections/list/list requests to detect anomalies

How to Mitigate CVE-2025-13879

Immediate Actions Required

Restrict network access to the SOLIDserver management interface using firewall rules or a management VLAN
Rotate administrator credentials and enforce multi-factor authentication on all privileged accounts
Review recent administrator activity for unexpected calls to /mod/ajax.php?action=sections/list/list
Contact EfficientIP support to confirm the availability of a fixed build for version 8.2.3

Patch Information

No vendor patch reference is published in the NVD record at the time of writing. Operators should consult EfficientIP support channels and monitor the EfficientIP IPAM Solutions Overview and the INCIBE CERT Directory Traversal Notice for updates and fixed version information.

Workarounds

Limit administrator role assignments to the minimum number of operators required for IPAM management
Place the SOLIDserver web interface behind a reverse proxy that rejects directory parameters containing traversal sequences or absolute paths
Apply session controls such as IP allow-listing and short session timeouts for administrator accounts

bash

# Example NGINX reverse proxy rule to block traversal attempts on the vulnerable endpoint
location /mod/ajax.php {
    if ($arg_action = "sections/list/list") {
        if ($args ~* "directory=(/|\.\./|%2e%2e|%2f)") {
            return 403;
        }
    }
    proxy_pass http://solidserver_backend;
}