CVE-2025-13353

Executive Summary

CVE-2025-13353 is a critical cryptographic flaw in Cloudflare's gokey utility (versions prior to 0.2.0). The vulnerability stems from a logic error in the seed decryption routine, where the AES-GCM authentication tag and initial vector (IV) were incorrectly used as the sole entropy source for password derivation, instead of the full 240-byte seed file. This reduces the effective entropy from 240 bytes to only 28 bytes (IV + tag), making generated secrets highly predictable. An attacker with access to the seed file can recover all derived passwords without knowledge of the master password. The vulnerability is patched in version 0.2.0, but this is a breaking change that invalidates all previously generated secrets.

Supply Chain & Package Security

gokey is a Go-based command-line utility distributed via GitHub releases. It is not a package on NPM, PyPI, or RubyGems. However, organizations using gokey as part of automated secret generation pipelines (e.g., CI/CD, infrastructure-as-code) must treat this as a supply chain risk. The vulnerable binary (v0.1.3 and earlier) may be embedded in Docker images, Terraform modules, or Ansible playbooks. Users should audit their software bill of materials (SBOM) for gokey versions < 0.2.0 and replace them immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires access to the seed file.
• Attack Complexity (AC): Low (L) – No special conditions beyond file access.
• Privileges Required (PR): Low (L) – Attacker needs read access to the seed file.
• User Interaction (UI): None (N) – No user action required beyond file access.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – All secrets derived from the seed are compromised.
• Integrity (I): High (H) – Attacker can generate valid credentials.
• Availability (A): None (N) – No denial-of-service impact.

Base Score: 7.1 (High) – The low attack complexity and high impact on confidentiality and integrity justify this score.

Deep Dive & Mechanics

The vulnerability lies in the decryptSeed function in gokey versions < 0.2.0. The seed file is encrypted using AES-256-GCM. The decryption process should extract the full plaintext (240 bytes) and use it as entropy for key derivation. However, due to a logic error, the code incorrectly used the AES-GCM authentication tag (16 bytes) and the initialization vector (12 bytes) as the entropy source, ignoring the actual seed plaintext.

Technical Flow:

1. User provides a master password and a seed file (-s option).
2. gokey decrypts the seed file using AES-256-GCM.
3. In vulnerable versions, the decryption function returns the IV and tag instead of the plaintext.
4. The key derivation function (KDF) uses only these 28 bytes (IV + tag) to generate the final secret.
5. This reduces entropy from 240 bytes to 28 bytes, making brute-force or precomputation attacks feasible.

Impact: An attacker with the seed file can:

• Recover all passwords generated from that seed without the master password.
• Predict future passwords if the same seed is reused with the vulnerable version.

Vulnerable vs. Patched Code

Vulnerable Code (v0.1.3):

func decryptSeed(seed []byte, password string) ([]byte, error) {
    // ... AES-GCM decryption logic ...
    // BUG: Returns nonce and tag instead of plaintext
    return append(nonce, tag...), nil
}

Patched Code (v0.2.0):

func decryptSeed(seed []byte, password string) ([]byte, error) {
    // ... AES-GCM decryption logic ...
    // FIX: Returns the actual decrypted plaintext
    return plaintext, nil
}

Key Difference: The patched version correctly returns the full 240-byte plaintext from the seed file, restoring the intended entropy.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a seed file (e.g., seed.enc) generated by gokey v0.1.3.
• gokey v0.1.3 binary (available from GitHub releases).

Steps:

1. Download the vulnerable version:

   wget https://github.com/cloudflare/gokey/releases/download/v0.1.3/gokey-v0.1.3-linux-amd64
   chmod +x gokey-v0.1.3-linux-amd64
   

2. Recover the master password (if unknown, skip this step; the seed file alone is sufficient).
3. Generate a password using the seed file:

   ./gokey-v0.1.3-linux-amd64 -p "any_password" -s seed.enc -o output.txt
   

4. The output password is derived from only 28 bytes of entropy. An attacker can brute-force the remaining 28-byte space (2^224 possibilities) or use precomputed tables for common seeds.

Proof of Concept (PoC):

# Simulate the vulnerable entropy reduction
import hashlib
# Assume IV and tag are extracted from seed file
iv = b'\x00' * 12
tag = b'\x00' * 16
# Vulnerable KDF uses only these 28 bytes
entropy = iv + tag
# Derive password (simplified)
password = hashlib.sha256(entropy).hexdigest()
print(f"Derived password: {password}")

Blue Team (Defender)

Detection Steps:

1. Identify all systems using gokey version < 0.2.0.
2. Locate seed files (typically .enc or .seed extensions).
3. Check for any secrets generated with the -s option.
4. Rotate all affected secrets immediately.

Lab Setup for Testing:

# Install patched version
wget https://github.com/cloudflare/gokey/releases/download/v0.2.0/gokey-v0.2.0-linux-amd64
chmod +x gokey-v0.2.0-linux-amd64

# Generate a new seed file
./gokey-v0.2.0-linux-amd64 -p "master_password" -g -o new_seed.enc

# Generate a new password
./gokey-v0.2.0-linux-amd64 -p "master_password" -s new_seed.enc -o new_password.txt

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • gokey v0.1.3 binary: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • Seed files generated by v0.1.3: Any seed file with a creation date before the patch date.
• Network Indicators: None (local vulnerability).
• Behavioral Indicators:
  • Unexpected password changes or access using credentials derived from seed files.
  • Presence of gokey binary in unusual locations (e.g., /tmp, /dev/shm).
• Log Artifacts:
  • Command-line execution of gokey with -s flag.
  • File access logs showing reads of seed files.

Detection Engineering

YARA Rule

rule CVE_2025_13353_gokey_vulnerable {
    meta:
        description = "Detects gokey binary versions < 0.2.0"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $gokey_magic = "gokey" ascii wide nocase
        $version_0_1 = "0.1." ascii wide nocase
        $version_0_0 = "0.0." ascii wide nocase
    condition:
        $gokey_magic and ($version_0_1 or $version_0_0)
}

Sigma Rule

title: Detection of gokey Seed File Usage
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of gokey with seed file option
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\gokey.exe'
        CommandLine|contains: '-s'
    condition: selection
falsepositives:
    - Legitimate use of patched gokey version
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13353 - gokey Seed File Download"; flow:to_server,established; content:"gokey"; http_uri; content:"v0.1."; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade gokey to version 0.2.0 or later.
2. Regenerate all secrets that were created using the -s option with the patched version.
3. Rotate credentials in all systems where these secrets were used.

Long-Term Mitigations:

• Implement secret rotation policies for all cryptographic tools.
• Use hardware security modules (HSMs) or key management services (KMS) for seed storage.
• Audit all secret generation scripts and CI/CD pipelines for use of gokey.

Workarounds:

• If upgrade is not immediately possible, avoid using the -s option and rely solely on the master password for key derivation.

Verification:

• After patching, generate a test password with the same seed file and master password. The output should differ from the previous version.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert