CVE-2025-24889

Executive Summary

CVE-2025-24889 is a path traversal vulnerability in the SecureDrop Client, a desktop application used by journalists to communicate with sources on the SecureDrop Workstation. The vulnerability resides in the sd-log virtual machine (VM), which is responsible for centrally collecting logs from other VMs. An attacker who has already achieved code execution on any other VM within the SecureDrop Workstation can exploit this flaw to perform lateral movement into the sd-log VM.

The core issue is a lack of sanitization of the source VM name when writing log files. The VM name, which is supplied by the logging VM itself, is used unsanitized in the destination path within sd-log. This allows an attacker to craft a malicious VM name containing path traversal sequences (e.g., ../). By doing so, the attacker can write a file named syslog.log with arbitrary content to any directory accessible by a low-privileged user. A critical exploitation vector involves writing this file to the /home/user/.config/autostart/ directory. Because XFCE (the desktop environment) treats any file in that directory as a .desktop file regardless of its extension, the attacker can achieve code execution by placing a malicious .desktop entry.

The vulnerability is not remotely exploitable and requires an initial foothold on another VM. The CVSS score is 4.5 (Medium), reflecting the high privileges required for exploitation but the potential for lateral movement within the isolated Qubes environment. Patches are available in versions 0.14.1 and 1.0.1.

Supply Chain & Package Security

This vulnerability is not directly related to a package registry (NPM, PyPI, Go, Ruby). However, the SecureDrop Client is a Python application distributed via Debian packages and GitHub releases. Users should ensure they are obtaining the software from the official SecureDrop sources and verifying package signatures to prevent supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
• Attack Vector (AV): Local (L) - The attacker must have local access to the system (i.e., code execution on a VM).
• Attack Complexity (AC): Low (L) - The attack does not require special conditions beyond the initial foothold.
• Privileges Required (PR): High (H) - The attacker needs code execution on another VM.
• User Interaction (UI): None (N) - No user interaction is required for exploitation.
• Scope (S): Changed (C) - The vulnerable component (sd-log) is different from the component providing the initial access (other VMs).
• Confidentiality (C): Low (L) - Limited access to log data.
• Integrity (I): Low (L) - Ability to write arbitrary files, but with constraints.
• Availability (A): Low (L) - Potential to disrupt logging services.

Threat Level: Medium. The requirement for an initial foothold significantly reduces the attack surface, but the potential for lateral movement within a highly secure environment like SecureDrop is a serious concern.

Deep Dive & Mechanics

The SecureDrop Workstation is built on Qubes OS, which uses Xen hypervisor virtualization to isolate different components into separate VMs. The sd-log VM is a dedicated, internet-isolated VM that collects logs from other VMs for debugging and support. Logs are ingested via a narrow Qubes RPC (qrexec) policy, which allows specific inter-VM communication using the Xen vchan protocol.

The vulnerability lies in the log writing logic within sd-log. When a VM sends a log entry, it includes its own VM name. The sd-log service uses this VM name to construct the file path where the log will be stored. The vulnerable code does not sanitize or validate the VM name, allowing an attacker to inject path traversal sequences.

Vulnerable Code Flow:

1. An attacker-controlled VM sends a log entry with a crafted source VM name, e.g., ../../home/user/.config/autostart/.
2. The sd-log service receives this name and constructs a path like /var/log/sd-log/../../home/user/.config/autostart/syslog.log.
3. The path resolves to /home/user/.config/autostart/syslog.log.
4. The attacker-controlled log content is written to this file.
5. XFCE's autostart mechanism treats syslog.log as a .desktop file, executing its contents on the next user login.

Patched Code Flow: The fix uses the Qubes environment variable QREXEC_REMOTE_DOMAIN, which is set by the Qubes RPC system and contains the actual source VM name. This value is trusted and cannot be manipulated by the sending VM. The patched code reads this variable instead of the user-supplied name, preventing path traversal.

Vulnerable vs. Patched Code

Vulnerable Code (Python-like pseudocode):

# Vulnerable: Uses untrusted VM name from the log message
def write_log(source_vm_name, log_content):
    log_path = f"/var/log/sd-log/{source_vm_name}/syslog.log"
    with open(log_path, "a") as f:
        f.write(log_content)

Patched Code (Python-like pseudocode):

# Patched: Uses trusted Qubes environment variable
import os

def write_log(log_content):
    source_vm_name = os.environ.get('QREXEC_REMOTE_DOMAIN')
    if not source_vm_name:
        # Handle error: no trusted source
        return
    # Sanitize the VM name to prevent path traversal
    safe_vm_name = source_vm_name.replace('/', '_').replace('..', '_')
    log_path = f"/var/log/sd-log/{safe_vm_name}/syslog.log"
    with open(log_path, "a") as f:
        f.write(log_content)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Code execution on any VM within the SecureDrop Workstation (e.g., sd-app, sd-proxy).
• Knowledge of the sd-log VM's log ingestion mechanism.

Exploitation Steps:

1. Craft Malicious Log Entry: Create a log entry with a crafted source VM name that includes path traversal.

   # Example payload to write to autostart directory
   malicious_vm_name = "../../home/user/.config/autostart"
   log_content = """
   [Desktop Entry]
   Type=Application
   Name=Malicious
   Exec=/bin/bash -c 'reverse_shell_or_payload'
   """
   # Send this log entry to sd-log via qrexec
   

2. Send the Log: Use the qrexec client to send the log entry to the sd-log VM.

   # Example qrexec command (simplified)
   qrexec-client-vm sd-log qubes.log.LogEntry <<< "$malicious_vm_name:$log_content"
   

3. Trigger Execution: Wait for a user to log in to the SecureDrop Workstation, or trigger a login event. The XFCE autostart mechanism will execute the malicious .desktop file.
4. Achieve Code Execution: The payload in the .desktop file runs in the context of the sd-log VM, granting the attacker code execution there.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file writes to /home/user/.config/autostart/ from the sd-log process.
• Monitor for log entries with suspicious VM names containing path traversal characters (../, ..\\).
• Monitor for unexpected processes spawned from the autostart directory.

Defense:

• Apply the patch immediately (upgrade to version 0.14.1 or 1.0.1).
• Implement file integrity monitoring (FIM) on the autostart directory.
• Restrict write access to the autostart directory to only trusted processes.
• Enable logging and alerting on qrexec calls to sd-log.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /home/user/.config/autostart/ (e.g., syslog.log).
  • Files with .desktop content but non-standard extensions in autostart.
• Processes:
  • Unusual processes spawned from /home/user/.config/autostart/.
  • Reverse shells or outbound connections from sd-log VM (which should be isolated).
• Logs:
  • Log entries in sd-log with VM names containing ../ or other path traversal sequences.
  • Anomalous qrexec calls to sd-log with unexpected source VM names.

Detection Engineering

YARA Rule

rule CVE_2025_24889_PathTraversal_LogEntry {
    meta:
        description = "Detects path traversal attempts in SecureDrop log entries targeting CVE-2025-24889"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24889"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $autostart = /autostart/i
    condition:
        $path_traversal and $autostart
}

Sigma Rule

title: CVE-2025-24889 SecureDrop Log Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in SecureDrop log entries
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24889
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - Message|contains: '../'
        - Message|contains: '..\\'
        - Message|contains: '/autostart/'
    condition: selection
falsepositives:
    - Legitimate log entries with similar patterns (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-24889 SecureDrop Log Path Traversal"; content:"../"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade SecureDrop Client to version 0.14.1 or 1.0.1 immediately.
2. Verify: Ensure all SecureDrop Workstation VMs are updated.
3. Monitor: Review logs for any signs of exploitation.

Long-Term Mitigations:

• Implement strict input validation for all inter-VM communication.
• Use trusted environment variables (like QREXEC_REMOTE_DOMAIN) for security-critical operations.
• Regularly audit and review Qubes RPC policies.
• Conduct penetration testing focusing on lateral movement within the Qubes environment.

Workarounds (if patching is not immediately possible):

• Manually restrict write permissions on the /home/user/.config/autostart/ directory.
• Implement a custom qrexec policy that validates the source VM name before forwarding logs to sd-log.

Valters IT