CVE-2023-25573

The vulnerability in the metersphere continuous testing platform stems from improper access control mechanisms within the API endpoint responsible for downloading files. Specifically, the flaw exists in the `/api/jmeter/download/files` route, which allows unauthenticated users to access and download files that should be restricted. This oversight means that any user, regardless of their authentication status, can potentially retrieve sensitive files stored on the server, including configuration files, test scripts, and other critical data. The lack of adequate access controls exposes the system to unauthorized data access, posing significant security risks to organizations utilizing this platform.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could leverage automated scripts or manual requests to interact with the vulnerable API endpoint, systematically probing for accessible files. Given that the vulnerability permits access to any file within the running process, an attacker could potentially download sensitive information that could be used for further attacks, such as credential harvesting, data exfiltration, or reconnaissance for additional vulnerabilities. In scenarios where the platform is deployed in environments with sensitive data, the implications of such unauthorized access could be severe, leading to data breaches or compliance violations.

The real-world impact of this vulnerability is substantial, particularly for organizations that rely on metersphere for continuous testing and development processes. The potential for unauthorized access to sensitive files can result in significant business risks, including reputational damage, financial loss, and legal repercussions. Organizations may face regulatory scrutiny if sensitive data is exposed, especially in industries governed by strict data protection regulations. Furthermore, the exploitation of this vulnerability could lead to a loss of customer trust, as clients may be concerned about the security of their data and the integrity of the testing processes.

To detect and mitigate this vulnerability, organizations should prioritize upgrading to the patched versions of metersphere, specifically versions 1.20.20 LTS and 2.7.1, which address the access control flaw. Regularly monitoring and auditing API endpoints for unauthorized access attempts can also help identify potential exploitation attempts. Implementing robust authentication mechanisms and ensuring that all sensitive endpoints enforce strict access controls are critical steps in safeguarding against similar vulnerabilities. Additionally, organizations should conduct regular security assessments and penetration testing to identify and remediate potential weaknesses in their systems proactively.

In conclusion, the improper access control vulnerability in metersphere presents a significant risk to organizations utilizing this continuous testing platform. The ease of exploitation and the potential for severe consequences underscore the importance of maintaining robust security practices. By promptly addressing the vulnerability through upgrades and implementing comprehensive security measures, organizations can mitigate the risks associated with unauthorized access and protect their sensitive data from potential breaches.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2023-25573, with our telemetry indicating a new confirmed sighting of exploitation attempts targeting the improper access control vulnerability in metersphere. Although the EPSS score remains stable at a high level, this fresh detection signals that threat actors are actively probing or exploiting this flaw in the wild. The absence of new exploit variants or ransomware group involvement suggests opportunistic scanning or targeted reconnaissance rather than widespread automated campaigns at this stage. For defenders, this development underscores the urgency of monitoring for unauthorized file access attempts and prioritizing patch deployment, as the vulnerability’s ease of exploitation continues to present a significant risk. While the overall threat level remains high, the emergence of active exploitation attempts elevates the immediacy of the threat, warranting increased vigilance and rapid response to any suspicious activity.

Update 2 — June 17, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2023-25573, with our telemetry indicating a doubling in observed exploitation attempts. Despite this increase, the EPSS score has notably declined, reflecting a reduced probability of widespread exploitation in the immediate term. This divergence suggests that while opportunistic scanning or targeted reconnaissance efforts are intensifying, broad automated campaigns have yet to materialize. For defenders, this evolving pattern underscores a heightened risk environment where adversaries are actively probing for vulnerable instances, increasing the likelihood of successful unauthorized file access if systems remain unpatched. Consequently, the threat level should be considered elevated, emphasizing the need for sustained monitoring and rapid identification of anomalous access behaviors to mitigate potential data exposure.