Gladinet CentreStack/Triofox Path Traversal

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_gather/gladinet_storage_path_traversal_cve_2025_11371

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit auxiliary module that exploits CVE-2025-11371, an unauthenticated path traversal vulnerability in Gladinet CentreStack/Triofox, to read arbitrary files from the server. It includes actions to read any file or specifically extract the machineKey from Web.config for use in further attacks.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2025-11371, a path traversal vulnerability, to read arbitrary files. It contains no backdoor, concealed payload, or operator-directed harm. All behavior is consistent with documented exploit functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesruby
Target softwareGladinet CentreStackGladinet Triofox
Attack typespath traversalinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively sends crafted requests to exploit a path traversal vulnerability and retrieve file contents, which constitutes exploitation rather than mere scanning or detection.

modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:18-20modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77

Requirements

  • Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.10.10408.56683).modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:27-28
  • The /storage/t.dn endpoint must be accessible and accept the 's' parameter with traversal sequences.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:22-23

Observed behavior

  • Sends an HTTP GET request to /storage/t.dn with a path traversal payload in the 's' parameter to read an arbitrary file.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77
  • If the response status is 200, the file content is returned and stored as loot.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:89-96
  • The EXTRACT_MACHINEKEY action reads Web.config and extracts the machineKey for use in ViewState deserialization attacks.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-148
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Path traversal via /storage/t.dn endpointThe module sends a GET request with a traversal path in the 's' parameter to read arbitrary files, matching the described vulnerability.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77
File Read
Reads Web.config and extracts machineKeyThe EXTRACT_MACHINEKEY action reads a file and passes content to handle_machinekey_extraction, which is a standard Metasploit mixin for extracting cryptographic keys.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-149
Loot Storage
Stores retrieved file content as lootThe module uses store_loot to save the retrieved file, which is normal Metasploit behavior for auxiliary/gather modules.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:116-125
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full exploit chain (e.g., handle_machinekey_extraction) is not visible.
  • The review covers only the module source file; framework mixins (e.g., Msf::Auxiliary::Gladinet, handle_machinekey_extraction) are not expanded, but their use is standard and non-suspicious.
  • Binary files are not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2