CVE-2025-30038: CGM CLININET Information Disclosure Flaw

CVE-2025-30038 Overview

CVE-2025-30038 is a session identifier disclosure vulnerability affecting CGM CLININET. When a user saves a file downloaded from the application, the session identifier is persisted alongside the file in an NTFS alternate data stream (ADS). The Zone.Identifier ADS, added by Windows to mark files from untrusted sources, retains the referrer URL that contains the active session ID. An attacker with access to the downloaded file can extract the identifier and impersonate the authenticated user. The issue is categorized under [CWE-1230] (Exposure of Sensitive Information Through Metadata).

Critical Impact
Session identifiers persisted in NTFS metadata allow adversaries to hijack authenticated CGM CLININET sessions and access clinical data.

Affected Products

CGM CLININET (Clinical information system by CompuGroup Medical)
Windows client workstations that download files from the application
NTFS volumes storing downloaded artifacts with Zone.Identifier metadata

Discovery Timeline

2025-08-27 - CVE-2025-30038 published to the National Vulnerability Database
2026-06-17 - Record last modified in NVD

Technical Details for CVE-2025-30038

Vulnerability Analysis

CGM CLININET issues file download URLs that embed the authenticated session identifier as a query parameter or path component. When Microsoft Edge, Chromium, or Internet Explorer save a file originating from a network zone flagged as untrusted, Windows appends a Zone.Identifier alternate data stream to the file. That stream stores the ReferrerUrl and HostUrl fields, both of which capture the full download URL, including the session token.

The attack does not require exploiting a memory safety issue or bypassing authentication logic. Any process able to read the saved file, including the file itself moved to shared storage, can extract the session ID from the ADS using standard Windows APIs.

Root Cause

The root cause is the transmission of a sensitive session credential inside a URL that Windows then records in file metadata. Session identifiers should be carried in HTTP headers or cookies scoped to the browser session, not in URL components that operating system features preserve on disk.

Attack Vector

An adjacent-network attacker who obtains a copy of a file saved from CGM CLININET can query the Zone.Identifier stream to recover the referrer URL and its embedded session ID. The token is then replayed against the CLININET application to hijack the victim's session. Files shared over network drives, email attachments, or endpoint backup archives are common exfiltration paths.

The Zone.Identifier stream can be read with commands such as more < filename.pdf:Zone.Identifier or by opening filename.pdf:Zone.Identifier through CreateFile. See the CERT Polska CVE-2025-2313 Analysis for technical details of the exposure pattern.

Detection Methods for CVE-2025-30038

Indicators of Compromise

Files saved from CGM CLININET containing a Zone.Identifier ADS with ReferrerUrl or HostUrl values that include session identifier query parameters.
CLININET application logs showing the same session ID authenticated from multiple client IP addresses or User-Agent strings.
Unexpected access to clinical records from workstations that did not originate the initial login.

Detection Strategies

Scan endpoint file systems for Zone.Identifier streams containing CLININET URLs with session tokens using Get-Item -Stream Zone.Identifier in PowerShell.
Correlate web server access logs to identify session identifiers reused across distinct source addresses within short intervals.
Alert on file-share activity where documents originating from CLININET are copied to locations accessible by unauthorized users.

Monitoring Recommendations

Enable Windows auditing of alternate data stream access (ReadData on :Zone.Identifier) on clinical workstations.
Monitor for anomalous session reuse and geographic or network context changes at the application layer.
Ingest CLININET authentication and file-download telemetry into a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2025-30038

Immediate Actions Required

Contact CompuGroup Medical for the vendor-supplied fix that removes session identifiers from download URLs.
Force logout of all active CLININET sessions and rotate session secrets after applying the patch.
Sweep endpoints and file shares for existing downloads that contain the leaked identifier inside Zone.Identifier streams and remove the ADS with Remove-Item -Stream Zone.Identifier.

Patch Information

Refer to the CERT Polska CVE-2025-2313 Analysis for vendor coordination details. Apply the CGM CLININET release that migrates session handling away from URL-embedded tokens to HTTP cookies or authorization headers.

Workarounds

Configure the browser or Group Policy to save CLININET downloads to a directory located on a non-NTFS volume, which prevents ADS creation.
Strip alternate data streams from downloaded files automatically using a scheduled task that runs Unblock-File or Remove-Item -Stream * on the download directory.
Shorten CLININET session lifetimes and bind sessions to client IP address or device fingerprint to reduce the value of a leaked identifier.

bash

# Remove Zone.Identifier streams from CLININET download directories
Get-ChildItem -Path 'C:\Users\*\Downloads\CLININET\*' -Recurse -Force |
  ForEach-Object { Remove-Item -Path $_.FullName -Stream 'Zone.Identifier' -ErrorAction SilentlyContinue }