New vulnerability module for Triofox CVE-2025-12480 detection - #1237
New vulnerability module for Triofox CVE-2025-12480 detection#1237Aarush289 wants to merge 8 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Summary by CodeRabbitRelease Notes
WalkthroughAdds a Triofox vulnerability module for CVE-2025-12480 and registers it in the module documentation. The module probes ChangesTriofox vulnerability module
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml`:
- Around line 1-24: The severity field in the info block for
triofox_improper_access_control_cve_2025_12480_vuln is incorrect; change the
severity value from 9.8 to the official CVSS v3 base score 9.1 by editing the
severity key in the YAML (info.name:
triofox_improper_access_control_cve_2025_12480_vuln, field: severity).
🧹 Nitpick comments (2)
nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml (2)
34-34: Clarify thessl: falsesetting.Setting
ssl: falsedisables SSL certificate verification. While this allows detecting vulnerable instances with self-signed certificates, it should be documented that this is intentional. This is a common pattern in vulnerability scanners but worth noting.
45-47: Consider adding common alternative ports.Triofox may be deployed on non-standard ports like 8080 or 8443. This is consistent with other modules in the repository (e.g., joomla_cve_2023_23752, paloalto modules), and adding these ports would improve detection coverage.
♻️ Suggested enhancement
ports: - 80 - 443 + - 8080 + - 8443
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml`:
- Around line 1-4: The repository requires signed commits before merge; sign all
new and existing commits that touch the
triofox_improper_access_control_cve_2025_12480_vuln metadata (the YAML change
shown) by configuring a GPG or SSH signing key locally, committing future
changes with git commit -S, and re-signing past unsigned commits with an
interactive rebase (e.g., git rebase -i --exec "git commit --amend --no-edit -S"
<base>) then push the branch with --force-with-lease so CI pre-merge checks
accept the update.
🧹 Nitpick comments (1)
nettacker/modules/vuln/triofox_improper_access_cve_2025_12480.yaml (1)
6-9: Broaden content match for CentreStack or narrow scope.
Line 6–7 mentions CentreStack, but Line 57 only matches “Triofox Enterprise”. If CentreStack branding differs, the detector may miss affected instances. Consider adding an alternate token (e.g., CentreStack) or update the description to Triofox-only after validating actual responses.Also applies to: 56-57
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
|
@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3e159b07e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - '**teamcity_cve_2024_27198_vuln**' – check the target for TeamCity CVE-2024-27198 vulnerability | ||
| - '**tieline_cve_2021_35336_vuln**' – check the target for Tieline CVE-2021-35336 vulnerability | ||
| - '**tjws_cve_2021_37573_vuln**' – check the target for TJWS CVE-2021-37573 vulnerability | ||
| - '**triofox_improper_access_control_cve_2025_12480_vuln**' - Checks for an unauthenticated improper access control vulnerability in Gladinet Triofox |
There was a problem hiding this comment.
Users who copy this name into -m/--modules cannot run the new scanner: module discovery derives the identifier from the filename as triofox_improper_access_cve_2025_12480_vuln, while this line documents an extra _control. The argument parser consequently reports that the documented scan module was not found; rename the file or use the filename-derived identifier consistently.
Useful? React with 👍 / 👎.
| - unauth | ||
| - exposure | ||
| - triofox | ||
| - kev |
There was a problem hiding this comment.
When users select --profile cisa_kev, this module is omitted because profile membership is built from exact tag strings and every other KEV module uses cisa_kev; this new kev tag instead creates a separate one-module profile. Since the module is intentionally marked as KEV, use the established tag so KEV-focused scans include this check.
Useful? React with 👍 / 👎.
2 participants
Proposed change
This PR adds a new vulnerability detection module for CVE-2025-12480, an improper access control vulnerability affecting Gladinet Triofox.
The vulnerability allows unauthenticated users to access restricted administrative or setup endpoints due to missing or insufficient access control checks. The module detects this issue by sending an unauthenticated HTTP request and validating access based on response behavior and content.
References:
Type of change
Checklist
make pre-commit, it didn't generate any changesmake test, all tests passed locallyAdditional details
Tested against:
curlSince the vulnerable version is not publicly available anymore , I could not test it against the actual server , rather I checked that the modules is correct in syntax and the detection logic is consistent with nuclie and huntress .