CVE-2025-8590: SKSPro Information Disclosure Vulnerability

CVE-2025-8590 Overview

CVE-2025-8590 is an Information Exposure vulnerability affecting SKSPro software developed by AKCE Software Technology R&D Industry and Trade Inc. The vulnerability enables directory indexing, allowing unauthorized actors to enumerate and access sensitive files and directories exposed through the web server. This type of vulnerability can lead to significant information disclosure, exposing internal file structures, configuration files, and potentially sensitive data to attackers.

Critical Impact

Attackers can exploit directory indexing to enumerate server contents, potentially accessing sensitive configuration files, backup data, credentials, and proprietary information without authentication.

Affected Products

• SKSPro (through version 07012026)
• AKCE Software Technology R&D Industry and Trade Inc. SKSPro deployments

Discovery Timeline

• 2026-02-03 - CVE-2025-8590 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-8590

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The directory indexing issue in SKSPro allows remote attackers to browse directory contents on the web server when a default index file (such as index.html or index.php) is not present in a directory. This exposes the file structure and potentially sensitive files to anyone who can reach the affected web application over the network.

The vulnerability requires no authentication and can be exploited with low complexity, making it accessible to attackers with minimal technical expertise. While the vulnerability does not directly allow modification of data or denial of service, the confidentiality impact is significant as attackers can potentially discover and download sensitive information.

Root Cause

The root cause of this vulnerability is improper web server configuration within the SKSPro application. Directory listing functionality is enabled by default or not properly disabled, allowing the web server to automatically generate an HTML page listing the contents of directories that lack a default index document. This misconfiguration exposes the internal directory structure and file names to unauthorized users.

Attack Vector

The attack can be performed remotely over the network without requiring any authentication or user interaction. An attacker simply needs to:

1. Identify directories on the SKSPro application that do not contain index files
2. Navigate to these directories via a web browser or HTTP client
3. Browse the automatically generated directory listing
4. Access and download exposed files

This type of attack is commonly used during reconnaissance phases to gather information about the target system, identify potentially vulnerable components, locate backup files, discover hidden administrative interfaces, or find configuration files containing sensitive data such as database credentials.

Detection Methods for CVE-2025-8590

Indicators of Compromise

• Unusual HTTP requests targeting directory paths without trailing index files
• Increased access to non-standard directory paths on the SKSPro application
• HTTP 200 responses for directory requests that would normally return 403 or redirect

Detection Strategies

• Monitor web server access logs for requests ending in directory paths (URLs ending with /) that return successful responses
• Implement web application firewall (WAF) rules to detect and alert on directory enumeration patterns
• Configure intrusion detection systems to identify automated directory scanning tools such as DirBuster or Gobuster

Monitoring Recommendations

• Enable detailed access logging on the SKSPro web server
• Set up alerting for suspicious patterns of directory traversal requests
• Perform regular security scans to identify exposed directories before attackers do

How to Mitigate CVE-2025-8590

Immediate Actions Required

• Disable directory indexing on all web server configurations hosting SKSPro
• Review exposed directories to identify any sensitive data that may have been disclosed
• Implement access controls to restrict unauthorized access to sensitive directories
• Consider rotating any credentials that may have been exposed through directory listings

Patch Information

For specific patch information, refer to the USOM Security Notification TR-26-0011 which provides official guidance from AKCE Software Technology R&D Industry and Trade Inc. regarding this vulnerability. Organizations should apply vendor-provided updates to SKSPro installations as soon as they become available.

Workarounds

• Disable directory indexing in the web server configuration (Apache: Options -Indexes, Nginx: autoindex off)
• Add default index files to all directories that should not display listings
• Implement .htaccess rules or equivalent to deny access to sensitive directories
• Deploy a web application firewall to block directory enumeration attempts

For Apache web servers, add the following to the configuration file or .htaccess:

# Disable directory indexing
Options -Indexes

# Deny access to sensitive directories
<Directory "/path/to/sensitive">
    Require all denied
</Directory>

For Nginx servers, update the server block configuration:

# Disable directory indexing
autoindex off;

# Deny access to sensitive locations
location /sensitive/ {
    deny all;
    return 403;
}