Path Traversal in Open ISES Download Endpoint

The Open ISES Project 3.30A contains a path traversal vulnerability in the ajax/download.php endpoint that allows unauthenticated attackers to download arbitrary files by manipulating the filename parameter. Attackers can supply directory traversal sequences ../ in the filename parameter to access files outside the intended directory, including configuration files and system files.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2018-25408 exploits a path traversal vulnerability in Open ISES Project 3.30A's ajax/download.php endpoint, allowing unauthenticated attackers to bypass directory restrictions and download arbitrary files. By injecting directory traversal sequences (../) into the filename parameter, adversaries can escape the intended download directory and access sensitive configuration files, system files, and other protected resources. This vulnerability is particularly dangerous because it requires no authentication, has a high CVSS score of 7.5, and affects any organization running the vulnerable version of Open ISES. The lack of input validation on the filename parameter creates a direct pathway for unauthorized file disclosure, potentially exposing credentials, database backups, and system configurations that could be leveraged for further attacks.

Casky's 331 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would observe detection findings focused on suspicious HTTP requests to the ajax/download.php endpoint containing path traversal payloads—such as requests with multiple ../ sequences in the filename parameter or attempts to access files outside expected directories (/etc/passwd, config files, etc.). The platform's skills would flag anomalous file access patterns indicating directory traversal exploitation, correlate unauthenticated access attempts to sensitive endpoints, and identify the reconnaissance behavior typical of adversaries probing for exploitable file download mechanisms. This multi-layered approach enables security teams to catch both active exploitation attempts and the reconnaissance activities that precede them.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25408.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2018-25408

Casky has 331 skills that investigate the attack patterns behind CVE-2018-25408. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn