CVE-2025-35053
📋 TL;DR
CVE-2025-35053 allows authenticated users in Newforma Info Exchange (NIX) to read and delete arbitrary files with NetworkService privileges via the '/UserWeb/Common/MarkupServices.ashx' endpoint. Combined with CVE-2025-35062 (anonymous access enabled by default), this can be exploited by unauthenticated attackers. Organizations using Newforma Info Exchange before version 2023.1 are affected.
💻 Affected Systems
- Newforma Info Exchange (NIX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file deletion leading to service disruption, or reading sensitive files containing credentials/configurations enabling lateral movement.
Likely Case
Unauthenticated attackers reading configuration files, deleting critical application files causing service disruption, or accessing sensitive project data.
If Mitigated
Limited to authenticated users only, restricting impact to authorized personnel with malicious intent.
🎯 Exploit Status
Exploitation requires sending crafted HTTP POST requests to the vulnerable endpoint. When combined with CVE-2025-35062, no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.1 or later
Vendor Advisory: https://www.newforma.com/security-advisories/
Restart Required: Yes
Instructions:
1. Upgrade Newforma Info Exchange to version 2023.1 or later. 2. Apply all security patches from Newforma. 3. Restart the NIX service after upgrade.
🔧 Temporary Workarounds
Disable Anonymous Access
allDisable anonymous authentication in NIX configuration to prevent unauthenticated exploitation via CVE-2025-35062.
Configure NIX authentication settings to require valid user credentials for all access.
Block Vulnerable Endpoint
windowsUse web application firewall or IIS URL rewrite rules to block access to '/UserWeb/Common/MarkupServices.ashx'.
Add URL rewrite rule in IIS to block requests to MarkupServices.ashx
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NIX servers from untrusted networks
- Enable detailed logging and monitoring for suspicious access to the MarkupServices.ashx endpoint
🔍 How to Verify
Check if Vulnerable:
Check NIX version via administrative interface. If version is below 2023.1, system is vulnerable.Check Version:
Check NIX web interface admin panel or consult Newforma documentation for version verification.Verify Fix Applied:
Confirm NIX version is 2023.1 or later and test that anonymous users cannot access the MarkupServices.ashx endpoint.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to '/UserWeb/Common/MarkupServices.ashx' with 'DownloadExportedPDF' parameter
- File deletion or access events from NetworkService account to unexpected paths
Network Indicators:
- Unusual HTTP traffic patterns to the MarkupServices.ashx endpoint
- Multiple failed authentication attempts followed by successful access to the endpoint
SIEM Query:
source="iis" AND cs_uri_stem="/UserWeb/Common/MarkupServices.ashx" AND cs_method="POST" AND cs_uri_query CONTAINS "DownloadExportedPDF"