CVE-2025-13879: SOLIDserver IPAM Path Traversal Flaw

CVE-2025-13879 Overview

CVE-2025-13879 is a directory traversal vulnerability affecting EfficientIP SOLIDserver IPAM v8.2.3. This security flaw allows an authenticated user with administrator privileges to list directories outside of their authorized access scope by manipulating the directory parameter in the /mod/ajax.php?action=sections/list/list endpoint. By setting the directory parameter to /, an attacker can enumerate files and directories outside the restricted LOCAL:/// folder, potentially exposing sensitive system information.

Critical Impact

Authenticated administrators can bypass directory restrictions to enumerate sensitive files and directories across the entire file system, potentially exposing confidential configuration data and system information.

Affected Products

• EfficientIP SOLIDserver IPAM v8.2.3

Discovery Timeline

• 2025-12-02 - CVE CVE-2025-13879 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-13879

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The vulnerability carries a CVSS 4.0 score of 5.1 (Medium severity) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

The EPSS (Exploit Prediction Scoring System) data indicates a probability of 0.246% with a percentile ranking of 47.759, suggesting a moderate likelihood of exploitation in the wild.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of the directory parameter within the AJAX handler at /mod/ajax.php. When processing requests with action=sections/list/list, the application fails to properly validate that the requested directory path remains within the authorized LOCAL:/// folder boundary. This lack of path canonicalization allows attackers to supply arbitrary path values that traverse outside the intended restricted directory structure.

Attack Vector

The attack vector is network-based (AV:N) with low attack complexity (AC:L). Exploitation requires high privileges (PR:H), meaning the attacker must possess valid administrator credentials. No user interaction is required (UI:N). The vulnerability enables confidentiality impact through unauthorized information disclosure (VC:L), though it does not affect integrity or availability.

An authenticated administrator can exploit this vulnerability by sending a crafted HTTP request to the vulnerable endpoint with a manipulated directory parameter. By setting this parameter to values such as / or using path traversal sequences, the attacker can enumerate files and directories across the entire file system, bypassing the intended LOCAL:/// folder restriction.

The vulnerable endpoint accepts user-controlled input in the directory parameter without proper validation, allowing the application to list contents of arbitrary directories accessible to the web server process.

Detection Methods for CVE-2025-13879

Indicators of Compromise

• Unusual HTTP requests to /mod/ajax.php?action=sections/list/list with suspicious directory parameter values
• Web server access logs showing requests with path traversal patterns (e.g., ../, /etc/, /var/)
• Administrator accounts making excessive directory listing requests outside normal operational patterns
• Requests containing directory=/ or other root-level path specifications to the vulnerable endpoint

Detection Strategies

Organizations should implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns targeting the SOLIDserver IPAM application. Monitor web server access logs for anomalous requests to /mod/ajax.php endpoints with unusual directory parameter values. Security teams should correlate authentication logs with web activity to identify potential abuse of administrator credentials.

SentinelOne Singularity provides behavioral detection capabilities that can identify suspicious file system enumeration activities originating from web application processes. The platform's AI-driven threat detection can recognize patterns consistent with directory traversal exploitation attempts.

Monitoring Recommendations

Enable detailed logging for all requests to the SOLIDserver IPAM web interface, particularly focusing on AJAX endpoints. Implement alerting for requests containing path traversal indicators such as ../, absolute paths outside expected directories, or requests to sensitive system directories. Regular review of administrator account activity and access patterns can help identify potential abuse scenarios.

How to Mitigate CVE-2025-13879

Immediate Actions Required

• Review EfficientIP security advisories and apply any available patches or updates for SOLIDserver IPAM
• Implement strict access controls to limit which users have administrator privileges
• Deploy web application firewall rules to block requests containing path traversal patterns
• Monitor administrator account activity for suspicious file enumeration behavior
• Consider network segmentation to limit access to the SOLIDserver IPAM management interface

Patch Information

Organizations should consult the vendor advisory from INCIBE-CERT at https://www.incibe.es/en/incibe-cert/notices/aviso/directory-traversal-vulnerability-efficientips-solidserver-ipam for the latest patch and remediation guidance. Contact EfficientIP support for specific update packages addressing this vulnerability. Review the vendor resource at https://efficientip.com/resources/solidserver-ipam-solutions-3/ for additional product information.

Workarounds

If immediate patching is not possible, organizations should implement compensating controls to reduce risk exposure. Restrict network access to the SOLIDserver IPAM management interface to trusted IP addresses only using firewall rules or network ACLs. Implement additional authentication layers such as VPN requirements for administrator access. Deploy a web application firewall configured to inspect and block requests to /mod/ajax.php containing suspicious directory parameter values.

Consider implementing the principle of least privilege by limiting the number of accounts with administrator access and requiring multi-factor authentication for all administrative sessions. Regular audit logging and monitoring of administrative actions can help detect exploitation attempts before significant data exposure occurs.