CVE-2025-15236
📋 TL;DR
QOCA aim AI Medical Cloud Platform has an absolute path traversal vulnerability that allows authenticated remote attackers to read folder names under specified paths. This affects healthcare organizations using Quanta Computer's medical cloud platform. Attackers must have valid credentials to exploit this vulnerability.
💻 Affected Systems
- QOCA aim AI Medical Cloud Platform
📦 What is this software?
Qoca Aim by Quantatw
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map the entire directory structure, identify sensitive medical data locations, and potentially combine with other vulnerabilities for data exfiltration.
Likely Case
Unauthorized directory enumeration leading to information disclosure about system structure and potentially sensitive folder names.
If Mitigated
Limited information disclosure about folder structure without access to actual file contents.
🎯 Exploit Status
Exploitation requires authenticated access but path traversal techniques are well-documented and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-10616-cd942-2.html
Restart Required: Yes
Instructions:
1. Contact Quanta Computer for patch details. 2. Apply the security update provided by the vendor. 3. Restart the QOCA aim platform services. 4. Verify the fix prevents path traversal attempts.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict input validation to reject path traversal sequences in user inputs
Configuration dependent - implement in application code
Access Control Restriction
allRestrict authenticated users' access to only necessary directories using principle of least privilege
Platform-specific access control configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns
- Monitor authentication logs for suspicious directory enumeration attempts
🔍 How to Verify
Check if Vulnerable:
Test authenticated API endpoints with path traversal payloads like '../../etc/passwd' or similar directory traversal sequencesCheck Version:
Check platform version through admin interface or contact Quanta Computer supportVerify Fix Applied:
Attempt the same path traversal attacks after patching - they should be blocked or return error responses📡 Detection & Monitoring
Log Indicators:
- Multiple failed attempts to access directories with traversal sequences
- Unusual pattern of directory enumeration requests from authenticated users
Network Indicators:
- HTTP requests containing '../' sequences in URL parameters
- Patterns of directory probing from single authenticated sessions
SIEM Query:
source="web_logs" AND (url="*../*" OR param="*../*") AND response_code=200