Unauthenticated Path Traversal in Group-Office Compress

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2018-25438 is an unauthenticated path traversal vulnerability in Intermesh Group-Office versions before 3.5.5 that allows remote attackers to read arbitrary files from affected servers. The vulnerability exists in the compress.php endpoint, where insufficient input validation on the 'file' parameter allows attackers to inject directory traversal sequences (../) to escape the intended cache directory and access sensitive files like /etc/passwd. This is particularly critical because it requires no authentication, has a CVSS score of 7.5, and affects a collaboration platform that often contains sensitive organizational data. Organizations running Group-Office 3.3.0 through 3.5.4 are directly impacted, and the vulnerability's discovery by the Shadowserver Foundation indicates real-world reconnaissance activity.

Casky's 351 mapped skills detect the attack patterns underlying this CVE through Claude AI's analysis of MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). When practitioners investigate suspicious compress.php requests, Casky correlates anomalous GET parameters containing path traversal sequences with reconnaissance behaviors. Practitioners would observe findings that flag requests containing '../' payloads in the 'file' parameter, identify attempts to access files outside intended directories, and correlate these with file read patterns characteristic of information gathering. The extended reasoning capabilities help practitioners understand not just that a request is malicious, but why it represents initial reconnaissance before lateral movement—enabling faster containment and threat hunting across their infrastructure for similar patterns of unauthenticated information disclosure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25438.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2018-25438

Casky has 351 skills that investigate the attack patterns behind CVE-2018-25438. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn