📄 Description (English)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing.This issue affects SKSPro: through 07012026.
🤖 AI Executive Summary
CVE-2025-8590 is a directory indexing vulnerability in AKCE Software Technology's SKSPro product that exposes sensitive information to unauthorized actors. With a CVSS score of 7.5, this vulnerability allows attackers to enumerate and access files and directories that should be restricted. The vulnerability affects SKSPro versions through 07012026, and while no public exploit is currently available, the high severity rating and information disclosure nature make immediate patching critical for affected organizations.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 2, 2026 23:36
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses significant risk to Saudi organizations using SKSPro, particularly in government agencies (NCA, CITC), banking sector (SAMA-regulated institutions), healthcare facilities, and energy companies that may utilize this software for document management or web services. Directory indexing vulnerabilities can expose confidential business documents, personal data, system configuration files, and credentials. Organizations in the Kingdom relying on SKSPro for sensitive operations face potential data breaches, regulatory non-compliance with SAMA and NCA requirements, and reputational damage.
🏢 Affected Saudi Sectors
Government (NCA, CITC, Ministry of Interior)
Banking and Financial Services (SAMA-regulated)
Healthcare (MOH facilities)
Energy (ARAMCO, utilities)
Telecommunications (STC, Mobily)
Education
E-commerce and Retail
🎯 MITRE ATT&CK Techniques
T1526 - Reconnaissance: Enumerate File Shares
T1087 - Reconnaissance: Account Discovery
T1580 - Reconnaissance: Cloud Infrastructure Discovery
T1538 - Reconnaissance: Cloud Service Discovery
T1526 - Reconnaissance: Enumerate File Shares
T1592 - Reconnaissance: Gather Victim Host Information
T1589 - Reconnaissance: Gather Victim Identity Information
⚖️ Saudi Risk Score (AI)
7.8
/ 10.0
🔧 Remediation Steps (English)
1. IMMEDIATE ACTIONS:
- Identify all systems running SKSPro and document their versions
- Disable directory indexing at the web server level (Apache/IIS configuration)
- Implement .htaccess or web.config rules to prevent directory listing
- Restrict access to sensitive directories using firewall rules and access controls
2. PATCHING:
- Apply the latest SKSPro patch immediately (versions after 07012026)
- Test patches in non-production environments first
- Schedule patching during maintenance windows with minimal business impact
3. COMPENSATING CONTROLS:
- Configure web server to return 403 Forbidden for directory requests
- Implement Web Application Firewall (WAF) rules to block directory enumeration attempts
- Enable detailed logging and monitoring of directory access attempts
- Conduct file system audit to identify exposed sensitive files
4. DETECTION RULES:
- Monitor HTTP requests with trailing slashes (/) to directories
- Alert on 200 OK responses to directory requests
- Track access to common sensitive paths (/admin, /config, /backup, /upload)
- Log and analyze requests containing directory traversal patterns
🔧 خطوات المعالجة (العربية)
1. الإجراءات الفورية:
- تحديد جميع الأنظمة التي تعمل بـ SKSPro وتوثيق إصداراتها
- تعطيل فهرسة الدلائل على مستوى خادم الويب (إعدادات Apache/IIS)
- تطبيق قواعد .htaccess أو web.config لمنع قائمة الدلائل
- تقييد الوصول إلى الدلائل الحساسة باستخدام قواعد جدار الحماية والتحكم في الوصول
2. التصحيح:
- تطبيق أحدث تصحيح SKSPro فوراً (الإصدارات بعد 07012026)
- اختبار التصحيحات في بيئات غير الإنتاج أولاً
- جدولة التصحيح خلال نوافذ الصيانة بأقل تأثير على العمل
3. الضوابط البديلة:
- تكوين خادم الويب لإرجاع 403 Forbidden لطلبات الدلائل
- تطبيق قواعد جدار تطبيقات الويب (WAF) لحظر محاولات تعداد الدلائل
- تفعيل السجلات التفصيلية ومراقبة محاولات الوصول إلى الدلائل
- إجراء تدقيق نظام الملفات لتحديد الملفات الحساسة المكشوفة
4. قواعد الكشف:
- مراقبة طلبات HTTP مع شرطات مائلة (/) للدلائل
- تنبيهات على استجابات 200 OK لطلبات الدلائل
- تتبع الوصول إلى المسارات الحساسة الشائعة (/admin, /config, /backup, /upload)
- تسجيل وتحليل الطلبات التي تحتوي على أنماط اجتياز الدلائل
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Information Security Policies and Procedures
ECC 2024 A.6.1.2 - Access Control and User Management
ECC 2024 A.8.2.1 - Classification and Handling of Information Assets
ECC 2024 A.12.4.1 - Event Logging and Monitoring
🔵 SAMA CSF
Governance & Risk Management - Information Security Risk Assessment
Protective Security - Access Control and Authentication
Protective Security - Data Protection and Privacy
Detection & Response - Security Monitoring and Incident Detection
🟡 ISO 27001:2022
ISO 27001:2022 A.5.1 - Policies for Information Security
ISO 27001:2022 A.6.1 - Screening and Onboarding
ISO 27001:2022 A.8.1 - User Endpoint Devices
ISO 27001:2022 A.8.2 - Privileged Access Rights
ISO 27001:2022 A.8.3 - Information Access Restriction
ISO 27001:2022 A.12.4 - Logging
🟣 PCI DSS v4.0.1
PCI DSS 1.1 - Firewall Configuration Standards
PCI DSS 2.1 - Default Passwords and Security Parameters
PCI DSS 6.2 - Security Patches and Updates
PCI DSS 10.2 - User Access Logging
🔗 References & Sources 1