PT-2025-47486 · Unknown · Egovframe-Common-Components

Pierre Barre · Published 2025-11-19 · Updated 2025-11-20 · CVE-2025-34337

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions eGovFramework/egovframe-common-components versions up to and including 4.3.1

Description The Web Editor image upload functionality within the software uses symmetric encryption for URL parameters but reveals an encryption oracle. This allows attackers to create valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types, embedding them into a download URL returned to the client. These encrypted parameters are then trusted by other endpoints, such as /utl/web/imageSrc.do and /cmm/fms/getImage.do. An unauthenticated attacker can exploit this to obtain encrypted representations of attacker-chosen identifiers and replay them to file-serving APIs. This bypasses access controls that rely on the secrecy of encrypted parameters, potentially allowing retrieval of arbitrary stored files without proper authorization. The vulnerable parameters are the encrypted server-side paths, filenames, and MIME types.

Recommendations Versions prior to 4.3.1 should be used.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2025-34337

Affected Products

Egovframe-Common-Components

References · 10

• 🔥 https://pierrekim.github.io/advisories/2025-egovframe.txt · Exploit
• 🔥 https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html · Exploit
• https://osv.dev/vulnerability/CVE-2025-34337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34337 · Security Note
• https://github.com/eGovFramework/egovframe-common-components · Note
• https://egovframe.go.kr/eng/sub.do?menuNo=2 · Note
• https://vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpoints · Note
• https://twitter.com/PierreKimSec/status/1991468969547764012 · Twitter Post
• https://t.me/CVEtracker/37747 · Telegram Post
• https://twitter.com/CVEnew/status/1991187291377934391 · Twitter Post