CVE-2025-47221 Overview
CVE-2025-47221 is an arbitrary file write vulnerability in Keyfactor SignServer versions prior to 7.3.2. The flaw resides in the ArchiveToDisk worker configuration properties ARCHIVETODISK_FILENAME_PATTERN, ARCHIVETODISK_PATH_BASE, and ARCHIVETODISK_PATH_PATTERN, which accept any path value without restriction. An authenticated user with administrative access can direct SignServer to write files into arbitrary directories on the server file system. This includes paths pointing to files that already exist, enabling overwrite of files accessible to the local JBoss user. The issue is classified under [CWE-284: Improper Access Control].
Critical Impact
An administrator can overwrite files owned by the local JBoss service account, potentially disrupting SignServer operation or tampering with application resources on disk.
Affected Products
- Keyfactor SignServer versions prior to 7.3.2
- Deployments using the ArchiveToDisk worker configuration
- SignServer instances running under the local JBoss user context
Discovery Timeline
- 2025-11-13 - CVE-2025-47221 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47221
Vulnerability Analysis
Keyfactor SignServer includes an ArchiveToDisk worker that persists signed artifacts to the local file system. The worker is configured through three properties: ARCHIVETODISK_FILENAME_PATTERN, ARCHIVETODISK_PATH_BASE, and ARCHIVETODISK_PATH_PATTERN. Prior to version 7.3.2, SignServer performed no validation or canonicalization on the values assigned to these properties.
An administrator can set any of these properties to an absolute path or a path containing traversal sequences. When the worker executes, SignServer resolves the resulting path and writes signing output to that location. Because the runtime process operates as the local JBoss user, the write succeeds for any file that user can modify. This allows administrators to place or overwrite files outside the intended archive directory, exceeding the trust boundary implied by the configuration UI.
Root Cause
The root cause is improper access control on configuration input. SignServer treats the ArchiveToDisk path properties as trusted operator input and skips validation against an allowlist of archive directories. No canonical path check rejects traversal sequences or absolute paths pointing outside the archive root, and no per-property permission check separates archive configuration from file system write authority.
Attack Vector
Exploitation requires authenticated access to the SignServer administrative interface. The attacker configures a signing worker so that one or more ARCHIVETODISK_* properties reference a target path — for example, an application configuration file, a script executed by the JBoss process, or a deployment artifact. Submitting a signing request through that worker triggers a write to the attacker-controlled path with JBoss user permissions. Because valid paths to existing files are accepted, the write overwrites the target file with signing output.
No public proof-of-concept or exploit code has been published for CVE-2025-47221. Refer to the Keyfactor SignServer CVE-2025-47221 Advisory for vendor technical detail.
Detection Methods for CVE-2025-47221
Indicators of Compromise
- Unexpected modifications to files owned by the JBoss user outside the configured SignServer archive directory
- ArchiveToDisk worker configurations containing absolute paths, .. traversal sequences, or references to system directories in ARCHIVETODISK_PATH_BASE or ARCHIVETODISK_PATH_PATTERN
- New or altered SignServer worker properties applied by administrator accounts without a corresponding change ticket
Detection Strategies
- Audit all SignServer worker configurations and export the current values of ARCHIVETODISK_FILENAME_PATTERN, ARCHIVETODISK_PATH_BASE, and ARCHIVETODISK_PATH_PATTERN for review.
- Correlate SignServer administrative audit logs with file system modification events on the host to identify writes originating from signing operations.
- Flag any signing worker whose archive path resolves outside the designated archive volume after canonicalization.
Monitoring Recommendations
- Enable file integrity monitoring on directories writable by the JBoss user, including application binaries, configuration files, and startup scripts.
- Forward SignServer administrative and audit logs to a centralized SIEM and alert on changes to ARCHIVETODISK_* properties.
- Track authentication events for SignServer administrator accounts and alert on logins from unusual sources or outside change windows.
How to Mitigate CVE-2025-47221
Immediate Actions Required
- Upgrade Keyfactor SignServer to version 7.3.2 or later on all affected instances.
- Review current ArchiveToDisk worker configurations and remove any paths that resolve outside the intended archive directory.
- Rotate credentials for SignServer administrator accounts and audit recent administrative activity for unauthorized configuration changes.
Patch Information
Keyfactor addressed CVE-2025-47221 in SignServer 7.3.2. Release details are documented in the Keyfactor SignServer Release Notes, and vendor guidance is available through the Keyfactor Support Portal. The fixed release restricts the paths accepted by the ArchiveToDisk properties so that writes cannot escape the archive directory.
Workarounds
- Restrict SignServer administrative access to a minimum set of trusted operators until the upgrade to 7.3.2 completes.
- Constrain the file system permissions of the JBoss runtime user so it cannot modify application binaries, systemd units, or shell profiles.
- Apply mandatory access controls such as SELinux or AppArmor profiles that confine SignServer writes to the designated archive path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
