CVE-2025-24355

Executive Summary

CVE-2025-24355 is a medium-severity information disclosure vulnerability in Updatecli, a tool for automating file update strategies. The flaw allows private Maven repository credentials (Basic Auth) to be leaked into application logs when a retrieval operation fails. While successful operations properly sanitize credentials, any failure—such as an incorrect artifact coordinate, a missing version, or a network error—causes the raw credentials to be written to logs. This exposes sensitive secrets to anyone with log access, including system administrators, SIEM operators, or attackers who have achieved initial access. The vulnerability is patched in version 0.93.0.

Supply Chain & Package Security

Updatecli is a Go-based CLI tool distributed via GitHub releases and package managers. The vulnerability directly impacts CI/CD pipelines and automated update workflows that interact with private Maven repositories. If an attacker gains access to logs (e.g., via a compromised CI runner, log aggregation service, or insider threat), they can extract credentials and pivot to the Maven repository, potentially compromising the entire software supply chain.

CVSS Breakdown & Threat Level

CVSS Score: 7.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is triggered during network operations to a Maven repository.
• Attack Complexity (AC): Low – No special conditions required; any failed retrieval leaks credentials.
• Privileges Required (PR): Low – An attacker needs access to logs, which may be obtained via other means.
• User Interaction (UI): None – The leak occurs automatically on failure.
• Scope (S): Unchanged – The vulnerable component is the only affected system.
• Confidentiality (C): High – Credentials are fully exposed.
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: High. Credential leakage in CI/CD pipelines can lead to supply chain compromise.

Deep Dive & Mechanics

The vulnerability resides in Updatecli's Maven source handler. When a pipeline defines a maven source with Basic Auth credentials (e.g., username and password), the tool constructs an HTTP client to fetch artifact metadata. On success, the response is processed and credentials are redacted from logs. However, in the error path—specifically when the HTTP request fails or the artifact is not found—the raw request URL or error message containing the credentials is logged without sanitization.

Root Cause: The logging function does not apply the same sanitization filter to error messages as it does to success messages. The credential redaction logic is only invoked in the happy path.

Attack Scenario:

1. An attacker gains read access to Updatecli logs (e.g., via a compromised CI/CD system, log aggregation service like Splunk/ELK, or a misconfigured log file).
2. The attacker triggers a failed Maven retrieval by providing a non-existent artifact coordinate in a pipeline (or waits for a natural failure).
3. The logs contain the full Basic Auth header or URL parameters with credentials.
4. The attacker extracts the credentials and uses them to access the private Maven repository.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.93.0):

// In maven.go or similar
func (m *Maven) fetchArtifact(url string) ([]byte, error) {
    req, _ := http.NewRequest("GET", url, nil)
    req.SetBasicAuth(m.username, m.password)
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        // VULNERABLE: logs the full URL or error without sanitization
        log.Errorf("Failed to fetch artifact: %s, error: %v", url, err)
        return nil, err
    }
    // ... success path sanitizes credentials
}

Patched Code (0.93.0+):

func (m *Maven) fetchArtifact(url string) ([]byte, error) {
    req, _ := http.NewRequest("GET", url, nil)
    req.SetBasicAuth(m.username, m.password)
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        // PATCHED: sanitize the URL before logging
        sanitizedURL := sanitizeCredentials(url)
        log.Errorf("Failed to fetch artifact: %s, error: %v", sanitizedURL, err)
        return nil, err
    }
    // ... success path unchanged
}

func sanitizeCredentials(url string) string {
    // Replace user:password in URL with redacted placeholder
    re := regexp.MustCompile(`://[^:]+:[^@]+@`)
    return re.ReplaceAllString(url, "://REDACTED:REDACTED@")
}

Exploitation & Lab Setup

Red Team

Objective: Extract Maven credentials from Updatecli logs.

Prerequisites:

• Access to Updatecli logs (e.g., via a compromised CI runner or log aggregation service).
• Ability to trigger a failed Maven retrieval (e.g., modify a pipeline to use a non-existent artifact).

Steps:

1. Identify Log Location: Determine where Updatecli logs are written (e.g., stdout, stderr, or a file like /var/log/updatecli.log).
2. Trigger Failure: Modify an Updatecli pipeline to include a Maven source with a non-existent artifact:

   sources:
     myartifact:
       kind: maven
       spec:
         repository:
           url: https://private-maven.example.com/repository
           username: "admin"
           password: "SuperSecret123!"
         groupid: "com.example"
         artifactid: "nonexistent"
         version: "9.9.9"
   

3. Execute Pipeline: Run updatecli apply --config pipeline.yaml.
4. Extract Credentials: Search logs for patterns like Basic YWRtaW46U3VwZXJTZWNyZXQxMjMh or https://admin:SuperSecret123!@private-maven.example.com/....

   grep -E '(Basic |https?://[^:]+:[^@]+@)' /var/log/updatecli.log
   

5. Decode Base64: If the credential is Base64-encoded, decode it:

   echo "YWRtaW46U3VwZXJTZWNyZXQxMjMh" | base64 -d
   

Blue Team

Objective: Detect and prevent credential leakage.

Detection:

• Monitor logs for patterns indicating credential exposure (see Detection Engineering).
• Alert on any occurrence of Basic followed by a Base64 string in Updatecli logs.
• Use file integrity monitoring to detect unauthorized changes to pipeline YAML files.

Prevention:

• Upgrade to Updatecli 0.93.0 or later.
• Implement log redaction at the log aggregation layer (e.g., using Logstash filters or Splunk field extractions).
• Restrict access to logs to only authorized personnel.
• Use short-lived, scoped credentials for Maven repositories.

Indicators of Compromise (IOCs)

• Log Entries: Lines containing Basic [A-Za-z0-9+/=]+ or https?://[^:]+:[^@]+@ in Updatecli logs.
• Network Traffic: Outbound connections to private Maven repositories with Basic Auth headers.
• File Hashes: Updatecli binary versions < 0.93.0 (SHA256 available on GitHub releases).
• Process Names: updatecli processes with arguments containing --config and Maven source definitions.

Detection Engineering

YARA Rule

rule CVE_2025_24355_Updatecli_Credential_Leak {
    meta:
        description = "Detects Updatecli log entries containing leaked Maven credentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24355"
    strings:
        $cred1 = /Basic [A-Za-z0-9+/=]{10,}/ 
        $cred2 = /https?:\/\/[^:]+:[^@]+@/
        $updatecli = "updatecli"
    condition:
        ($cred1 or $cred2) and $updatecli
}

Sigma Rule

title: Updatecli Maven Credential Leak
id: cve-2025-24355
status: experimental
description: Detects Updatecli log entries containing leaked Maven Basic Auth credentials
author: Valters IT
date: 2025/04/10
logsource:
    product: linux
    service: updatecli
detection:
    selection:
        - EventID: 1  # Process creation (Sysmon)
          CommandLine|contains: "updatecli"
        - EventID: 4103  # PowerShell pipeline (if applicable)
          Payload|contains: "updatecli"
    keywords:
        - "Basic "
        - "https://*:*@"
    condition: selection and keywords
falsepositives:
    - Legitimate credential usage in non-error scenarios (patched versions)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24355 Updatecli Maven Credential Leak"; flow:to_server; content:"Authorization|3a| Basic "; nocase; pcre:"/Basic [A-Za-z0-9+/=]{10,}/"; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Updatecli version 0.93.0 or later.
2. Rotate any credentials that may have been exposed in logs.
3. Review log retention policies and purge any logs containing plaintext credentials.

Long-term:

• Implement credential scanning in CI/CD pipelines (e.g., using GitLeaks or TruffleHog).
• Use secret management tools (e.g., HashiCorp Vault, AWS Secrets Manager) instead of hardcoded credentials.
• Apply the principle of least privilege to log access.
• Enable audit logging for all credential access.

Workaround (if patching is not immediately possible):

• Redirect Updatecli logs to a secure, monitored location.
• Implement a log shipper that redacts patterns matching Basic [A-Za-z0-9+/=]+ before storage.

Valters IT
DevSecOps & Cyber Threat Intelligence