Intermesh Group-Office: Unauthenticated path traversal (CVE-2018-25438)

Intermesh Group-Office versions 3.3.0 through 3.5.4 contain an unauthenticated path traversal vulnerability in the compress.php component. An attacker can exploit this by sending a crafted HTTP GET request to /compress.php, manipulating the 'file' parameter with directory traversal sequences (such as '../'). The application insecurely appends this input to a cache path and passes it to the readfile() function, resulting in the disclosure of arbitrary files from the host filesystem. The Shadowserver Foundation reported exploitation in the wild starting October 21, 2023.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the underlying host operating system, such as /etc/passwd, potentially leading to credential theft or system compromise.

Recommendation

• Upgrade Intermesh Group-Office to version 3.5.5 or later to resolve the vulnerability.
• Implement request validation on all web server inputs to block directory traversal sequences such as '../'.
• Restrict access to /compress.php via web application firewall (WAF) rules or network access controls if immediate patching is not possible.