CVE-2025-53897: Accellion Kiteworks MFT CSRF Vulnerability

CVE-2025-53897 Overview

CVE-2025-53897 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Kiteworks Managed File Transfer (MFT). The flaw affects versions prior to 9.1.0. Kiteworks MFT orchestrates end-to-end file transfer workflows for enterprise environments. An external attacker can trick an authenticated administrator into visiting a crafted page. The crafted page issues unauthorized requests to the Kiteworks MFT instance and returns log information back to the attacker. Kiteworks patched the issue in version 9.1.0.

Critical Impact
Successful exploitation exposes system log data to unauthenticated external attackers when an administrator is socially engineered into loading a malicious page.

Affected Products

Accellion Kiteworks Managed File Transfer versions prior to 9.1.0
Deployments where administrators maintain active authenticated browser sessions
Instances reachable from administrator workstations with internet browsing access

Discovery Timeline

2025-11-29 - CVE-2025-53897 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53897

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness affecting log-retrieval functionality in Kiteworks MFT. The application accepts state-changing or data-returning requests from an administrator session without validating that the request originated from a legitimate Kiteworks UI. An attacker hosting a crafted page can leverage the administrator's authenticated session to trigger requests that surface log content. Confidentiality and integrity impacts are rated High in the CVSS vector, while availability is unaffected. Exploitation requires user interaction and has high attack complexity, since the attacker must lure an administrator to a controlled page.

Root Cause

The root cause is missing or insufficient anti-CSRF protection on endpoints that expose log information. The application does not require a unique, unpredictable token bound to the administrator session for these requests. Same-site cookie enforcement and origin/referrer validation are also insufficient to block cross-origin invocation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a page containing hidden requests or scripted fetches targeting the victim's Kiteworks MFT instance. When an authenticated administrator visits the page, the browser attaches session credentials to the outbound requests. The attacker's page then reads or exfiltrates log data returned by the application. The vulnerability is described in the Kiteworks GitHub Security Advisory GHSA-cxwc-7899-3h4m.

Detection Methods for CVE-2025-53897

Indicators of Compromise

Web server access logs showing administrator requests to log-retrieval endpoints with Referer or Origin headers pointing to unknown external domains.
Administrator sessions initiating log-access requests immediately after browsing untrusted external sites.
Outbound browser telemetry showing HTML documents that reference the Kiteworks MFT hostname from third-party origins.

Detection Strategies

Correlate proxy logs with Kiteworks MFT access logs to identify cross-origin request patterns targeting administrative functions.
Alert on administrator-authenticated requests to log endpoints that lack the expected internal Referer header.
Deploy browser isolation or CSP violation reporting on administrator workstations to surface unexpected cross-origin form submissions.

Monitoring Recommendations

Monitor Kiteworks MFT audit logs for spikes in log-retrieval activity tied to a single administrator account.
Track administrator web browsing telemetry for connections to newly registered or low-reputation domains.
Ingest Kiteworks MFT and web proxy events into a centralized SIEM for cross-source correlation and long-term retention.

How to Mitigate CVE-2025-53897

Immediate Actions Required

Upgrade Kiteworks MFT to version 9.1.0 or later on all affected instances.
Terminate active administrator sessions after the upgrade and require re-authentication.
Restrict administrative access to dedicated hardened workstations that do not browse the public internet.

Patch Information

Kiteworks resolved the CSRF issue in Kiteworks MFT 9.1.0. Administrators should follow the remediation steps documented in the Kiteworks Security Advisory GHSA-cxwc-7899-3h4m. Verify the running version after upgrade and confirm that anti-CSRF tokens are present on log-related endpoints.

Workarounds

Enforce network-level allowlisting so the Kiteworks MFT administrative interface is only reachable from trusted management networks.
Require administrators to use a separate browser profile or isolated browser session exclusively for Kiteworks MFT.
Configure strict SameSite=Strict cookie enforcement and block third-party cookies on administrator browsers where supported.

bash

# Configuration example: restrict Kiteworks admin UI to management subnet (nginx front-end)
location /admin/ {
    allow 10.10.50.0/24;   # management subnet
    deny  all;
    proxy_pass https://kiteworks-backend;
    proxy_set_header X-Frame-Options "DENY";
    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'";
}