On April 16, 2025, CERT Polska reported several vulnerabilities affecting Symfonia’s software product, Ready_. Each identified vulnerability, registered under different CVE (Common Vulnerabilities and Exposures) IDs, pertains to versions ranging from 7.0.0.0 to 7.19.39.23. The vulnerabilities are as follows:
-
CVE-2025-1980: This vulnerability, classified as a "Carga sin restricciones de archivo con tipo peligroso" (CWE-434), allows users to upload files of any type and extension without restriction. If the server is misconfigured, which was a common occurrence following installations during 2021 and 2022, this can lead to remote code execution. This represents a significant security risk, as attackers could exploit this flaw to run unauthorized commands on the server.
-
CVE-2025-1981: This issue stems from inadequate neutralization of user-supplied input, specifically concerning a search functionality in the invoices module of Ready_. This flaw, identified as "inyección SQL" (CWE-89), permits low-privileged users to execute SQL injection attacks. Such attacks can compromise the integrity of the database and potentially expose sensitive information, leading to further exploitation of the system.
-
CVE-2025-1982: This vulnerability involves the accessibility of files or directories to external parties (CWE-552). It occurs in the file upload panel of Ready_, where low-privileged users can use the
file://protocol to link to local files. This could enable attackers to read sensitive system file contents, posing a substantial threat to data confidentiality. - CVE-2025-1983: This security flaw is classified under "Neutralización inadecuada de la entrada durante la generación de páginas web" (CWE-79), leading to Cross-Site Scripting (XSS) vulnerabilities. Specifically, it allows arbitrary JavaScript injection into file names during the file upload process in Ready_. Infected inputs are then stored server-side and executed whenever users interact with the affected files, resulting in potential theft of session tokens or other malicious actions.
In summary, CERT Polska’s issuance of these CVEs underlines the significant security challenges associated with the Ready_ software. It highlights potential severe risks including remote code execution, SQL injection, local file inclusion, and Cross-Site Scripting vulnerabilities. Attackers can use these vulnerabilities to gain heightened access to the system, read unintended files, and execute malicious code.
The disclosures followed a responsible vulnerability reporting process, emphasizing the collaborative engagement between CERT Polska and Symfonia. Special thanks were given to Maksymilian Kubiak, Sławomir Zakrzewski, and Jakub Stankiewicz from the Afine team for their contributions to identifying and reporting these vulnerabilities.
For organizations utilizing the affected versions of Ready_, it is crucial to take immediate action by updating to secure versions or applying necessary patches to mitigate these risks. Users should remain vigilant and monitor their systems for any unusual activities that may indicate attempts to exploit these vulnerabilities. CERT Polska has provided guidelines on their coordinated disclosure process, facilitating better security awareness and practices among software providers and users alike. More information on this process can be found at their official website: CERT Polska.
Overall, these vulnerabilities highlight the importance of secure software practices and underline the value of ongoing collaboration between cybersecurity teams and software developers to enhance security measures and protect user data.