CVE-2025-59744: Andsoft E-tms Path Traversal Vulnerability

CVE-2025-59744 Overview

A path traversal vulnerability has been identified in AndSoft's e-TMS version 25.03, a transportation management system used for logistics and fleet operations. This vulnerability allows an unauthenticated attacker to access files within the web root directory by manipulating the docurl parameter in the /lib/asp/DOCSAVEASASP.ASP endpoint. While the vulnerability is limited to files within the web root, it can still expose sensitive configuration files, application source code, and other critical data that could facilitate further attacks.

Critical Impact

Unauthenticated attackers can read arbitrary files within the web root, potentially exposing sensitive configuration data, credentials, and application source code.

Affected Products

• AndSoft e-TMS v25.03
• AndSoft e-TMS (earlier versions may also be affected)

Discovery Timeline

• 2025-10-02 - CVE CVE-2025-59744 published to NVD
• 2025-10-02 - Last updated in NVD database

Technical Details for CVE-2025-59744

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the document handling functionality within AndSoft's e-TMS web application. The vulnerable endpoint /lib/asp/DOCSAVEASASP.ASP accepts a user-controlled parameter called docurl that is not properly sanitized before being used to access files on the server. An attacker can craft malicious requests containing directory traversal sequences to navigate outside the intended directory structure and access files within the web root.

The vulnerability requires no authentication and can be exploited remotely over the network. While the scope is limited to files within the web root directory, this boundary still encompasses potentially sensitive resources including ASP source files, configuration files, database connection strings, and other application components.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the docurl parameter in the DOCSAVEASASP.ASP file. The application fails to properly validate user-supplied path input, allowing directory traversal sequences such as ../ to be processed. This permits attackers to break out of the intended document directory and access other files within the web application's root directory structure.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable endpoint with manipulated docurl parameter values containing path traversal sequences. The server processes these malicious paths without proper validation, returning the contents of files outside the intended directory scope.

The vulnerability manifests in the document retrieval functionality where the docurl parameter is used to specify file locations. By injecting directory traversal sequences (e.g., ../), an attacker can navigate the server's file system within the web root boundary to access sensitive files. For detailed technical information, refer to the INCIBE Security Notice.

Detection Methods for CVE-2025-59744

Indicators of Compromise

• HTTP requests to /lib/asp/DOCSAVEASASP.ASP containing directory traversal sequences (../, ..%2f, %2e%2e/) in the docurl parameter
• Unusual access patterns to the DOCSAVEASASP.ASP endpoint from external IP addresses
• Web server logs showing successful retrieval of configuration or source code files through the document handler
• Multiple sequential requests attempting to enumerate files within the web root directory

Detection Strategies

• Configure web application firewall (WAF) rules to detect and block path traversal patterns in URL parameters, particularly targeting the docurl parameter
• Implement intrusion detection system (IDS) signatures to identify HTTP requests containing encoded directory traversal sequences targeting ASP endpoints
• Enable detailed logging on the e-TMS application server and monitor for access to sensitive files through the DOCSAVEASASP.ASP handler
• Deploy file integrity monitoring on the web root directory to detect unauthorized access attempts

Monitoring Recommendations

• Monitor web server access logs for requests to /lib/asp/DOCSAVEASASP.ASP with suspicious parameter values
• Set up alerts for high volumes of requests to the vulnerable endpoint from single IP addresses
• Implement log correlation to identify reconnaissance activity preceding exploitation attempts
• Review application logs for error messages indicating failed file access attempts that may indicate probing activity

How to Mitigate CVE-2025-59744

Immediate Actions Required

• Restrict access to the /lib/asp/DOCSAVEASASP.ASP endpoint using network-level controls or web server configuration until a patch is available
• Implement WAF rules to block requests containing path traversal sequences in the docurl parameter
• Review and restrict file system permissions on the web root to limit the impact of potential exploitation
• Monitor for exploitation attempts and consider temporarily disabling the affected document functionality if not business-critical

Patch Information

Consult the INCIBE Security Notice for the latest information regarding available patches and updates from AndSoft. Organizations should contact their AndSoft support representative for specific patch availability and upgrade guidance.

Workarounds

• Deploy a web application firewall (WAF) with rules to detect and block path traversal patterns targeting the vulnerable endpoint
• Use network segmentation to limit exposure of the e-TMS application to trusted networks only
• Implement application-level access controls to restrict access to the document handling functionality
• Consider using a reverse proxy to filter and sanitize incoming requests before they reach the application server

# Example IIS URL Rewrite rule to block path traversal attempts
# Add to web.config in the e-TMS application root
# <rule name="BlockPathTraversal" stopProcessing="true">
#   <match url=".*" />
#   <conditions>
#     <add input="{QUERY_STRING}" pattern="(\.\.)" />
#   </conditions>
#   <action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
# </rule>