Kiteworks MFT存在跨站请求伪造 (CSRF) 漏洞

The primary impact of CVE-2025-53897 lies in the potential exposure of Kiteworks MFT log data. While not a direct path to system compromise, access to logs can reveal valuable information about file transfer activity, user behavior, and potentially sensitive data handled by the system. An attacker could leverage this information for reconnaissance, identifying valuable assets, or planning further attacks. The CSRF nature of the vulnerability means that an attacker doesn't need to authenticate to exploit it, relying instead on tricking a legitimate administrator. This makes it a relatively easy-to-exploit vulnerability, especially in environments where administrators frequently interact with the Kiteworks MFT interface.

Organizations utilizing Kiteworks MFT for secure file transfer, particularly those running versions prior to 9.1.0, are at risk. Environments with less stringent administrator training or those lacking robust web application firewalls are especially vulnerable.

1. 2025-11-29Disclosure

   disclosure

1. 已保留2025-07-11
2. 发布日期2025-11-29
3. 修改日期2025-12-01
4. EPSS 更新日期2026-03-23

The definitive mitigation for CVE-2025-53897 is to upgrade Kiteworks MFT to version 9.1.0 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing stricter access controls and user awareness training to minimize the risk of administrator interaction with malicious websites. While a direct workaround for CSRF is difficult, implementing robust input validation and output encoding can help prevent the exploitation of other related vulnerabilities. Regularly review Kiteworks MFT logs for any suspicious activity that might indicate a CSRF attack attempt. After upgrading, confirm the fix by attempting to trigger a log access request via a crafted URL and verifying that it fails.