Detect Gladinet Triofox Improper Access Control Exploitation Detected in Splunk
Detects exploitation attempts targeting CVE-2025-12480, an improper access control vulnerability (CWE-284) in Gladinet Triofox. This vulnerability allows attackers to bypass access controls, potentially gaining unauthorized access to file storage and collaboration resources. Listed as a CISA Known Exploited Vulnerability, active exploitation has been observed in the wild.
MITRE ATT&CK
SPL Detection Query
index=web OR index=iis OR index=windows sourcetype IN ("iis", "ms:iis:auto", "WinEventLog:Security", "XmlWinEventLog:Security")
| eval is_triofox_path=if(match(uri_path, "(?i)(/api/|/fileupload|/download|/share|/admin|/user/login|/token)"), 1, 0)
| eval is_triofox_proc=if(match(process, "(?i)(triofox|centrestack|gladinet)"), 1, 0)
| where is_triofox_path=1 OR is_triofox_proc=1
| eval auth_bypass=if(status IN ("200","201") AND match(uri_path, "(?i)(/admin|/user/login|/token)"), 1, 0)
| eval anomalous_method=if(method IN ("DELETE","PUT","PATCH") AND match(uri_path, "(?i)/admin"), 1, 0)
| bucket _time span=5m
| stats
count AS request_count,
dc(uri_path) AS distinct_uris,
values(status) AS status_codes,
sum(auth_bypass) AS auth_bypass_hits,
sum(anomalous_method) AS anomalous_method_hits,
earliest(_time) AS first_seen,
latest(_time) AS last_seen
BY _time, src_ip
| where request_count > 20 OR auth_bypass_hits > 3 OR anomalous_method_hits > 1
| eval severity=case(auth_bypass_hits > 5, "critical", request_count > 100, "high", true(), "medium")
| eval cve="CVE-2025-12480"
| table _time, src_ip, request_count, distinct_uris, status_codes, auth_bypass_hits, anomalous_method_hits, severity, cve, first_seen, last_seen
| sort -severity, -request_countSplunk query detecting CVE-2025-12480 exploitation against Gladinet Triofox by identifying high-frequency requests, authentication bypass attempts, and anomalous HTTP methods targeting administrative and API endpoints.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate Triofox desktop client bulk synchronization creating high request volumes from known IPs
- Authorized penetration testing or vulnerability scanning against the Triofox instance
- Monitoring agents or health-check systems polling authentication endpoints
- Administrative scripts performing batch user management operations via the API
Other platforms for CVE-2025-12480
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Triofox Unauthenticated Admin Endpoint Probe
Expected signal: IIS access log entries showing GET requests to /api/user/list, /admin/dashboard, /admin/users, /token, /api/settings from the test machine IP without authentication headers. Windows Security Event ID 4625 may appear if the application logs failed authentication attempts.
- Test 2Triofox Token Endpoint Brute Force Simulation
Expected signal: IIS log entries showing 30 POST requests to /token from the test IP within seconds, with HTTP 401 or 200 response codes. Application-level Triofox logs may record authentication attempts.
- Test 3Triofox File Access Path Traversal Probe
Expected signal: Windows Security event logs and IIS access logs recording HTTP GET requests to file-related Triofox endpoints without valid session tokens. Network telemetry in CrowdStrike or EDR showing outbound HTTP connections from the test machine to the Triofox server.
Response Playbook
Triage
- Identify the source IP(s) generating anomalous requests and cross-reference against known Triofox client IPs, VPN egress ranges, and authorized service accounts to determine if the activity originates from a legitimate user.
- Review IIS or application logs for the specific HTTP methods, URI paths, and response codes associated with the requests — focus on successful (200/201) responses to /admin, /token, and /user/login endpoints which may indicate successful access control bypass.
- Check the Triofox server version against the vendor's release history at https://access.triofox.com/releases_history to determine if the instance is running a patched version or remains vulnerable.
- Correlate the timeframe of suspicious requests with Triofox application logs and Windows Security Event logs (Event IDs 4624, 4625, 4648) to identify any authentication events associated with the anomalous source.
Containment
- If exploitation is confirmed or strongly suspected, immediately block the offending source IP(s) at the network perimeter or web application firewall level, and isolate the Triofox server from external network access pending investigation and patching.
- Rotate all Triofox service account credentials, API tokens, and shared secrets, and invalidate all active user sessions to prevent continued unauthorized access using credentials or tokens that may have been harvested during exploitation.
- Apply the vendor patch from https://access.triofox.com/releases_history immediately, or if patching cannot be performed immediately, implement WAF rules to block known exploit patterns targeting the access control bypass endpoints.
Evidence Collection
- Capture and preserve complete IIS access logs, application event logs, and Windows Security Event logs from the Triofox server for the period spanning at least 72 hours prior to detection through current time, ensuring log integrity with cryptographic hashing.
- Collect memory dump and disk image of the Triofox server if active compromise is suspected, preserving volatile state including running processes, network connections, and loaded modules before remediation actions alter forensic evidence.
- Export Triofox audit logs showing user activity, file access, share creation, and administrative actions to identify what data or resources may have been accessed or exfiltrated during the exploitation window.
Escalation Criteria
- !Escalate immediately to incident response if successful authentication or resource access is confirmed from the suspicious source IP, particularly if sensitive files, user credentials, or administrative functions were accessed.
- !Escalate to executive leadership and legal/compliance teams if the Triofox server stores regulated data (PII, PHI, financial records) and unauthorized access is confirmed, triggering mandatory breach notification assessment timelines.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS access logs (default: C:\inetpub\logs\LogFiles\W3SVC*) containing HTTP requests, source IPs, URI paths, HTTP methods, response codes, and user agents for the exploitation window - >
Windows Application Event Log entries from Triofox/CentreStack application source containing authentication, authorization, and error events corresponding to the access control bypass - >
Windows Security Event Log entries (Event IDs 4624, 4625, 4648, 4672) on the Triofox server showing logon events, failed authentications, and privilege use during the suspected exploitation period - >
Triofox application-level audit logs (typically stored in the application database or flat log files in the Triofox installation directory) recording user sessions, file access events, share operations, and administrative actions
Tuning Guidance
Begin by building an allowlist of known Triofox client IP ranges (desktop sync clients, mobile clients, authorized integrations) and reducing alert noise by excluding these from the detection threshold checks. Adjust the request_count threshold (default: 20 requests per 5-minute window) based on baseline traffic analysis from your Triofox deployment — environments with many active users will have higher legitimate baselines. Consider narrowing detection to focus specifically on successful (HTTP 200/201) responses to /admin and /token endpoints from IPs not in the allowlist, which provides high-fidelity signals for access control bypass with lower false positive rates. If Triofox is behind a reverse proxy or load balancer, ensure you are capturing the original client IP from X-Forwarded-For headers rather than the proxy IP.
Hunting Queries
Threat hunt for unauthenticated successful HTTP responses to Triofox administrative and API endpoints over the past 7 days, surfacing potential prior exploitation activity that may have occurred before detection rules were tuned.
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ('/admin', '/token', '/user/login', '/api/')
| where sc-status in (200, 201)
| where cs-username == '-' or cs-username == ''
| summarize
SuccessfulUnauthRequests = count(),
DistinctURIs = dcount(csUriStem),
URIs = make_set(csUriStem, 20)
by cIP, bin(TimeGenerated, 1h)
| where SuccessfulUnauthRequests > 3
| order by SuccessfulUnauthRequests descindex=iis sourcetype="iis" earliest=-7d
| where (uri_path="/admin*" OR uri_path="/token*" OR uri_path="/user/login*" OR uri_path="/api/*")
| where status IN ("200", "201")
| where (username="-" OR isnull(username) OR username="")
| stats count AS unauth_success, dc(uri_path) AS distinct_uris, values(uri_path) AS uris BY src_ip, date_hour
| where unauth_success > 3
| sort - unauth_successAtomic Red Team Tests
Simulates an attacker probing Triofox administrative endpoints without authentication to test for CVE-2025-12480 access control bypass. Tests whether the server returns 200 responses to unauthenticated requests to sensitive paths.
Command
#!/bin/bash
# Lab use only - test against authorized Triofox instance
TRIOFOX_HOST="http://triofox-lab.internal"
ENDPOINTS=("/api/user/list" "/admin/dashboard" "/admin/users" "/token" "/api/settings")
for endpoint in "${ENDPOINTS[@]}"; do
echo "[*] Testing: ${TRIOFOX_HOST}${endpoint}"
response=$(curl -sk -o /dev/null -w "%{http_code}" -X GET "${TRIOFOX_HOST}${endpoint}" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
-H "Accept: application/json" \
--connect-timeout 5)
echo "[*] Response code: ${response}"
if [ "$response" = "200" ] || [ "$response" = "201" ]; then
echo "[!] Potential access control bypass at ${endpoint} - HTTP ${response}"
fi
doneCleanup
No persistent changes made; review IIS logs on target to confirm telemetry generated.Expected Telemetry
IIS access log entries showing GET requests to /api/user/list, /admin/dashboard, /admin/users, /token, /api/settings from the test machine IP without authentication headers. Windows Security Event ID 4625 may appear if the application logs failed authentication attempts.
Expected Detection
KQL/SPL queries should flag the source IP for exceeding request thresholds to admin/API endpoints, particularly if any return HTTP 200 responses to unauthenticated requests.
Simulates rapid sequential requests to the Triofox authentication token endpoint to test detection of access control bypass via token manipulation or brute-force authentication, characteristic of CVE-2025-12480 exploitation chains.
Command
#!/bin/bash
# Lab use only - authorized testing only
TRIOFOX_HOST="http://triofox-lab.internal"
TOKEN_ENDPOINT="/token"
echo "[*] Sending 30 rapid requests to token endpoint"
for i in $(seq 1 30); do
curl -sk -o /dev/null -w "Request ${i}: %{http_code}\n" \
-X POST "${TRIOFOX_HOST}${TOKEN_ENDPOINT}" \
-H "Content-Type: application/json" \
-H "User-Agent: TriofoxClient/1.0" \
-d '{"username":"testuser","password":"testpass","grant_type":"password"}' \
--connect-timeout 3
done
echo "[*] Completed token endpoint stress test"Cleanup
No persistent changes; verify test entries in IIS logs are identifiable by User-Agent string TriofoxClient/1.0 for cleanup.Expected Telemetry
IIS log entries showing 30 POST requests to /token from the test IP within seconds, with HTTP 401 or 200 response codes. Application-level Triofox logs may record authentication attempts.
Expected Detection
Detection rules should trigger on the source IP exceeding the 20-request threshold within the 5-minute window, with the token endpoint being a high-signal indicator for access control bypass attempts.
Tests Triofox file download and share endpoints for unauthorized access patterns consistent with CVE-2025-12480 improper access control, attempting to access resources without proper authentication tokens.
Command
# Lab use only - PowerShell - authorized testing only
$TriofoxHost = "http://triofox-lab.internal"
$TestPaths = @(
"/download?file=../../../etc/passwd",
"/share/list",
"/api/files",
"/api/files?path=/",
"/fileupload",
"/api/user/profile"
)
$Results = @()
foreach ($path in $TestPaths) {
try {
$response = Invoke-WebRequest -Uri "$TriofoxHost$path" -Method GET `
-Headers @{'User-Agent'='Mozilla/5.0'; 'Accept'='application/json'} `
-UseBasicParsing -ErrorAction SilentlyContinue -TimeoutSec 5
$Results += [PSCustomObject]@{Path=$path; StatusCode=$response.StatusCode; Length=$response.Content.Length}
if ($response.StatusCode -eq 200) {
Write-Host "[!] Potential bypass: $path returned HTTP 200" -ForegroundColor Red
}
} catch {
$Results += [PSCustomObject]@{Path=$path; StatusCode='Error'; Length=0}
}
}
$Results | Format-Table -AutoSizeCleanup
No persistent changes; check IIS logs on target for test entries identifiable by Mozilla/5.0 User-Agent from test machine IP.Expected Telemetry
Windows Security event logs and IIS access logs recording HTTP GET requests to file-related Triofox endpoints without valid session tokens. Network telemetry in CrowdStrike or EDR showing outbound HTTP connections from the test machine to the Triofox server.
Expected Detection
Queries should flag successful (HTTP 200) responses to /api/files, /share/list, or /download endpoints without valid authentication, and the aggregate request count should exceed detection thresholds within the observation window.