CVE-2025-47220 Overview
CVE-2025-47220 is a local file enumeration vulnerability in Keyfactor SignServer versions prior to 7.3.2. The flaw resides in the VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH property used by the PDFSigner and PAdESSigner components. An admin user can set this property to any filesystem path without restriction. When the referenced file exists but is not a recognized image format, the application returns an error to the client, confirming the file's presence on the host. The issue is categorized under [CWE-284] Improper Access Control and enables enumeration of files readable by the application server user.
Critical Impact
Authenticated admin users can enumerate arbitrary files on the SignServer host filesystem, exposing sensitive filesystem layout and configuration data.
Affected Products
- Keyfactor SignServer versions prior to 7.3.2
- PDFSigner component
- PAdESSigner component
Discovery Timeline
- 2025-11-13 - CVE-2025-47220 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47220
Vulnerability Analysis
The vulnerability affects the visible signature configuration logic in Keyfactor SignServer's PDF signing workers. The VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH property accepts arbitrary filesystem paths supplied by administrators. SignServer attempts to load the referenced file as an image resource during signature rendering setup. The application does not restrict the path to a whitelisted directory or validate its scope against a sandboxed image repository.
When the referenced path resolves to an existing file that cannot be parsed as an image, the server returns a distinct error indicating an invalid image format. When the path does not exist, a different error is returned. This differential response allows an authenticated admin to enumerate files across the filesystem based on error signaling.
Root Cause
The root cause is missing access control on a user-supplied path parameter [CWE-284]. The signer components trust admin-provided input without applying path allowlisting, canonicalization, or containment checks. The image-loading routine's error handling then leaks existence information through observable response differences.
Attack Vector
Exploitation requires administrative access to the SignServer worker configuration interface. An attacker with admin privileges configures VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH on a PDFSigner or PAdESSigner worker to probe candidate paths such as /etc/shadow, private key locations, or backup files. The response error type reveals whether each path exists and is readable by the application server user. The vulnerability manifests through configuration property manipulation rather than direct file transmission. See the Keyfactor SignServer CVE-2025-47220 Advisory for vendor technical details.
Detection Methods for CVE-2025-47220
Indicators of Compromise
- Unusual modifications to VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH on PDFSigner or PAdESSigner workers, particularly paths outside the configured image directory.
- Repeated worker configuration updates that reference filesystem paths such as /etc/, /root/, or private key directories.
- SignServer application logs containing image-format errors tied to non-image filesystem paths.
Detection Strategies
- Audit SignServer worker property change history and flag any VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH value that does not reside within the sanctioned image asset directory.
- Correlate admin authentication events with worker property modification events to identify enumeration patterns from a single session.
- Alert on high-frequency worker reconfiguration by a single admin account within a short time window.
Monitoring Recommendations
- Forward SignServer audit logs to a centralized log platform and retain them for administrative review.
- Monitor administrative account activity for anomalous configuration probing behavior.
- Baseline expected values for signer worker properties and alert on deviations.
How to Mitigate CVE-2025-47220
Immediate Actions Required
- Upgrade Keyfactor SignServer to version 7.3.2 or later.
- Review the current value of VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH on all PDFSigner and PAdESSigner workers and reset any path pointing outside the approved image directory.
- Rotate administrative credentials if unexpected configuration changes are observed in audit logs.
Patch Information
Keyfactor addressed the vulnerability in SignServer 7.3.2. Refer to the Keyfactor SignServer Release Notes and the vendor advisory on the Keyfactor Support Portal for upgrade guidance.
Workarounds
- Restrict SignServer administrative access to a small set of trusted operators and enforce multi-factor authentication on those accounts.
- Limit filesystem read access for the account running the application server, so that only files in the sanctioned image directory are accessible.
- Enable and review administrative audit logging on all worker property changes until the patch is applied.
# Verify SignServer version and inspect signer configuration
signserver-cli getstatus | grep -i version
signserver-cli getconfig <WORKER_ID> | grep VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
