CVE-2025-27920 Overview
CVE-2025-27920 is a directory traversal vulnerability in Srimax Output Messenger before version 2.0.63. The application performs improper file path handling, allowing authenticated remote attackers to use ../ sequences in request parameters to access files outside the intended directory. Successful exploitation exposes configuration files and other sensitive content on the server filesystem.
The vulnerability is tracked under CWE-24: Path Traversal: '../filedir'. CISA added CVE-2025-27920 to the Known Exploited Vulnerabilities catalog after Microsoft attributed in-the-wild exploitation to the threat actor Marbled Dust for regional espionage operations.
Critical Impact
Remote attackers with low-privileged credentials can read arbitrary files on the Output Messenger server, leading to configuration leakage, credential theft, and follow-on intrusion activity.
Affected Products
- Srimax Output Messenger Server versions prior to 2.0.63
- Deployments exposing the Output Messenger web interface to untrusted networks
- Enterprise messaging environments using vulnerable Output Messenger builds
Discovery Timeline
- 2025-05-05 - CVE-2025-27920 published to the National Vulnerability Database
- 2025-05-12 - Microsoft publishes analysis attributing exploitation to Marbled Dust
- 2025-11-05 - Last updated in NVD database
Technical Details for CVE-2025-27920
Vulnerability Analysis
The flaw resides in the Output Messenger server's handling of user-supplied file path parameters. The application accepts file references from HTTP request parameters and joins them to a base directory without canonicalizing the path or filtering directory traversal sequences. An authenticated user can submit values containing ../ segments to escape the intended directory and reach arbitrary locations on the host filesystem.
Microsoft Threat Intelligence reported that Marbled Dust used this directory traversal as a zero-day to retrieve files from Output Messenger servers operated by targets aligned with their regional intelligence priorities. The attribution and exploitation details are documented in the Microsoft Security Blog on Marbled Dust.
Root Cause
The root cause is missing input validation on file path parameters. The server concatenates user input into a filesystem path without rejecting .. components or resolving the final path against an allowlisted base directory. Standard defenses such as path canonicalization and prefix checks are absent in versions prior to 2.0.63.
Attack Vector
Exploitation requires network access to the Output Messenger server and low-privileged authenticated credentials. An attacker crafts an HTTP request containing a parameter value with sequences such as ../../../../etc/passwd or paths pointing at Output Messenger configuration files. The server returns the contents of the targeted file. Refer to the Output Messenger advisory for the full list of affected endpoints and remediation guidance.
Detection Methods for CVE-2025-27920
Indicators of Compromise
- HTTP requests to Output Messenger endpoints containing ../, ..\\, or URL-encoded variants such as %2e%2e%2f in parameters
- Unexpected reads of Output Messenger configuration files, credential stores, or files outside the application install directory
- Outbound connections from Output Messenger hosts to infrastructure referenced in Microsoft's Marbled Dust reporting
- New or modified files on Output Messenger servers consistent with the post-exploitation tooling described by Microsoft
Detection Strategies
- Inspect web access logs for parameter values containing traversal sequences targeting Output Messenger URLs
- Alert on Output Messenger process activity that reads files outside the application's expected working directories
- Correlate authenticated Output Messenger sessions with anomalous file-read patterns and lateral movement attempts
Monitoring Recommendations
- Forward Output Messenger server logs and host telemetry into a centralized analytics platform such as Singularity Data Lake for retention and search
- Enable behavioral identification on Output Messenger hosts to surface post-exploitation activity, including credential access and discovery commands
- Track CISA KEV updates and threat intelligence on Marbled Dust to refine hunting queries
How to Mitigate CVE-2025-27920
Immediate Actions Required
- Upgrade Output Messenger Server to version 2.0.63 or later on all hosts
- Rotate credentials, API tokens, and configuration secrets that may have been exposed through the traversal flaw
- Restrict network access to the Output Messenger management and web interfaces to trusted administrative networks
- Review authentication logs and file access telemetry for indicators consistent with Marbled Dust activity
Patch Information
Srimax has released Output Messenger 2.0.63, which corrects path handling on the affected endpoints. Patch availability and download instructions are documented in the Output Messenger CVE-2025-27920 advisory. Because CVE-2025-27920 is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies must remediate within the mandated timeline.
Workarounds
- Block external access to Output Messenger web endpoints at the perimeter until the patch is applied
- Enforce strong authentication and disable unused accounts to reduce the population of users who could initiate traversal requests
- Place a web application firewall in front of Output Messenger and drop requests containing directory traversal patterns
- Monitor the Output Messenger installation directory for unauthorized file reads and configuration changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
