CVE-2025-14591

Executive Summary

CVE-2025-14591 is a security advisory affecting Delphix Continuous Compliance version 2025.3.0 and later. The vulnerability arises from a bug fix intended to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files. The fix introduced a new issue: using an incorrect EOR configuration can cause inaccurate parsing, leading to Personally Identifiable Information (PII) remaining unmasked. This is a data exposure vulnerability that could allow an attacker to access sensitive data that should have been masked.

Affected Ecosystem: Delphix Continuous Compliance (proprietary software, not open source).

Supply Chain & Package Security: This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a configuration and parsing issue within a proprietary Delphix product.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been assigned. However, based on the description, the vulnerability is a data exposure issue. The threat level is Medium due to the potential for PII exposure, but exploitation requires specific conditions (incorrect EOR configuration).

Deep Dive & Mechanics

The vulnerability is rooted in the parsing logic for delimited files within Delphix Continuous Compliance. The software is designed to mask PII in data files. A recent bug fix attempted to correctly handle CR+LF (Windows/DOS) line endings. However, this fix introduced a flaw: if the EOR configuration is set incorrectly (e.g., using only LF when the file uses CR+LF, or vice versa), the parser may misinterpret record boundaries. This can cause the masking engine to skip certain fields or records, leaving PII unmasked.

Root Cause: The parsing logic does not properly validate or enforce the EOR configuration against the actual file format. This is a classic CWE-228: Improper Handling of Syntactically Invalid Structure.

Attack Vector: An attacker who can influence the EOR configuration or provide a crafted delimited file with mixed or unexpected line endings could trigger the parsing error. The attacker would need access to the Delphix system or the ability to upload files.

Vulnerable vs. Patched Code

Since this is a proprietary product, specific code snippets are not available. However, the conceptual difference is:

Vulnerable Code (Conceptual):

def parse_delimited_file(file, eor_config):
    if eor_config == "CRLF":
        records = file.split("\r\n")
    elif eor_config == "LF":
        records = file.split("\n")
    # No validation that the file actually uses the configured EOR
    for record in records:
        mask_pii(record)

Patched Code (Conceptual):

def parse_delimited_file(file, eor_config):
    # Detect actual EOR from the file
    actual_eor = detect_eor(file)
    if actual_eor != eor_config:
        raise ConfigurationError("EOR configuration does not match file format")
    if eor_config == "CRLF":
        records = file.split("\r\n")
    elif eor_config == "LF":
        records = file.split("\n")
    for record in records:
        mask_pii(record)

Exploitation & Lab Setup

Red Team (Exploitation):

1. Setup: Deploy Delphix Continuous Compliance version 2025.3.0 or later.
2. Craft Payload: Create a delimited file (e.g., CSV) with mixed line endings. For example, use CR+LF for most records but LF for a record containing PII.
3. Configure EOR: Set the EOR configuration to LF (or CR+LF, opposite of the majority).
4. Upload/Process: Upload the file to the Delphix system for processing.
5. Observe: The parser will incorrectly split records, causing the PII in the record with the unexpected line ending to be left unmasked.

Blue Team (Detection & Defense):

1. Monitor Configuration Changes: Alert on any changes to EOR configuration settings.
2. Validate File Format: Implement a pre-processing step to validate that the file's actual line endings match the configured EOR.
3. Audit Logs: Review logs for parsing errors or warnings related to EOR mismatches.
4. Test with Malformed Files: Use fuzzing techniques to test the parser with various line ending combinations.

Indicators of Compromise (IOCs)

• Log Entries: Parsing warnings or errors related to EOR configuration mismatches.
• File Anomalies: Delimited files with mixed line endings (CR+LF and LF) in the same file.
• Configuration Changes: Unauthorized changes to EOR settings in Delphix Continuous Compliance.
• Data Exposure: Unmasked PII in output files that should have been masked.

Detection Engineering

YARA Rule:

rule Detect_Mixed_Line_Endings {
    meta:
        description = "Detects files with mixed CR+LF and LF line endings, potential CVE-2025-14591 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $crlf = "\r\n"
        $lf = "\n"
    condition:
        #crlf > 0 and #lf > 0
}

Sigma Rule:

title: Delphix EOR Configuration Mismatch
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects EOR configuration mismatch errors in Delphix Continuous Compliance logs
logsource:
    product: delphix
    service: continuous_compliance
detection:
    selection:
        EventID: 1001
        Message: "EOR configuration mismatch"
    condition: selection
falsepositives:
    - Legitimate configuration changes
level: medium

Suricata Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Delphix CVE-2025-14591 - Potential PII Exposure"; flow:to_server; content:"Delphix"; nocase; content:"Continuous Compliance"; nocase; content:"EOR"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Configuration: Ensure EOR configuration matches the actual file format being processed.
2. Validate Files: Implement a pre-processing step to detect and reject files with mixed line endings.
3. Monitor Logs: Actively monitor for parsing errors or warnings.

Long-Term Fix:

1. Apply Patch: Contact Delphix support for an official patch that validates EOR configuration against file content.
2. Upgrade: Upgrade to a patched version when available.
3. Code Review: If using custom scripts, review parsing logic for similar issues.

Workaround:

• Normalize all delimited files to a single line ending format (e.g., LF) before processing.

Valters IT