Overview
CVE-2025-34337 describes a significant security vulnerability affecting eGovFramework common components versions up to and including 4.3.1. This vulnerability is an unauthenticated encryption oracle that allows attackers to retrieve arbitrary files from the server without proper authorization. KISA/KrCERT has identified this vulnerability as “KVE-2023-5281.”
Technical Details
The vulnerability lies within the Web Editor’s image upload and file delivery functionality. The affected endpoints, /utl/wed/insertImage.do and /utl/wed/insertImageCk.do, encrypt server-side paths, filenames, and MIME types using symmetric encryption and embed them into download URLs returned to the client. The vulnerability arises because these encrypted parameters are trusted by other endpoints like /utl/web/imageSrc.do and /cmm/fms/getImage.do.
An unauthenticated attacker can exploit this by using the image upload functionality to obtain encrypted representations of attacker-chosen identifiers. These ciphertext values can then be replayed to the file-serving APIs, bypassing access controls that rely solely on the secrecy of the encrypted parameters.
CVSS Analysis
Currently, the CVSS score and severity are listed as N/A. However, considering the potential for arbitrary file retrieval without authentication, this vulnerability should be considered critical. A proper risk assessment should be conducted within your specific environment.
Possible Impact
Successful exploitation of CVE-2025-34337 could have severe consequences, including:
- Data Breach: Exposure of sensitive information stored on the server.
- Unauthorized Access: Bypassing access controls, leading to unauthorized system access.
- System Compromise: Potential for further exploitation after retrieving sensitive files.
Mitigation and Patch Steps
Currently, there is no known patch available. It is strongly advised to:
- Monitor for Updates: Regularly check the eGovFramework website and security advisories for official patches and updates.
- Implement Workarounds: If possible, disable or restrict access to the affected endpoints (
/utl/wed/insertImage.do,/utl/wed/insertImageCk.do,/utl/web/imageSrc.do, and/cmm/fms/getImage.do) until a patch is available. - Enhance Access Controls: Implement robust access controls that do not rely solely on the secrecy of encrypted parameters. Consider multi-factor authentication and role-based access control.
- Web Application Firewall (WAF): Deploy a WAF with rules to detect and block malicious requests targeting the vulnerable endpoints.
