CVE-2025-27222
📋 TL;DR
CVE-2025-27222 is a path traversal vulnerability in TRUfusion Enterprise's /trufusionPortal/getCobrandingData endpoint that allows attackers to read arbitrary files on the server. This can expose sensitive data including cleartext passwords for the TRUfusion system itself. All TRUfusion Enterprise installations through version 7.10.4.0 are affected.
💻 Affected Systems
- Rocket TRUfusion Enterprise
📦 What is this software?
Trufusion Enterprise by Rocketsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of TRUfusion Enterprise credentials leading to full system takeover, exposure of all server files accessible to the TRUfusion user, and potential lateral movement to connected systems.
Likely Case
Exfiltration of sensitive configuration files, database credentials, and TRUfusion passwords enabling unauthorized access to business integration systems.
If Mitigated
Limited file access restricted by OS permissions, but still potential exposure of configuration files and credentials.
🎯 Exploit Status
The vulnerability requires no authentication and has simple exploitation via path traversal sequences in requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
Restart Required: No
Instructions:
Contact Rocket Software for patch availability and apply immediately when released. Monitor vendor communications for updates.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allRestrict access to the /trufusionPortal/getCobrandingData endpoint using web application firewall or network controls.
Input Validation Filter
allImplement input validation to reject path traversal sequences (../, ..\, etc.) at the application or WAF layer.
🧯 If You Can't Patch
- Isolate TRUfusion servers from internet access and restrict internal network access to authorized users only.
- Implement strict file system permissions to limit what the TRUfusion service account can access.
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /trufusionPortal/getCobrandingData with path traversal payloads like ../../../../etc/passwd and checking if server returns file contents.Check Version:
Check TRUfusion Enterprise version in administration console or configuration files.Verify Fix Applied:
Retest with same payloads after applying vendor patch or workarounds to confirm file access is blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /trufusionPortal/getCobrandingData containing ../ or ..\ sequences
- Unusual file access patterns from TRUfusion process
Network Indicators:
- HTTP requests with path traversal patterns to the vulnerable endpoint
- Unexpected file downloads from TRUfusion servers
SIEM Query:
source="trufusion.log" AND (uri="/trufusionPortal/getCobrandingData" AND (uri="*../*" OR uri="*..\\*"))