CVE-2025-37728

Executive Summary

CVE-2025-37728 is a vulnerability in the Crowdstrike connector that exposes insufficiently protected credentials. A malicious user with access to a space can create and run a Crowdstrike connector, thereby accessing cached credentials from another Crowdstrike connector within the same environment. This leads to credential leakage, potentially allowing lateral movement or unauthorized access to Crowdstrike APIs. The CVSS score is 5.4 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood currently. No public exploit code or patch details are available.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but rather to a proprietary connector within the Crowdstrike ecosystem. Supply chain risks are limited to the connector's deployment and credential storage mechanisms.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs access to a space
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – credentials leaked
• Integrity Impact: Low (I:L) – potential misuse of credentials
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authenticated access to a space, but once achieved, credential leakage is straightforward.

Deep Dive & Mechanics

The vulnerability lies in how the Crowdstrike connector caches credentials. When a connector is created in a space, its credentials (API keys, tokens) are stored in a shared cache accessible by other connectors within the same environment. A malicious user can create a new Crowdstrike connector in a space they control, and the connector's runtime will read the cached credentials from other connectors. This is due to insufficient isolation of credential storage between different connector instances.

Root Cause: The credential cache is not scoped per connector or per user, allowing cross-connector access.

Attack Flow:

1. Attacker gains access to a space (e.g., via compromised user account).
2. Attacker creates a new Crowdstrike connector in that space.
3. The connector's initialization process reads the shared credential cache.
4. Attacker extracts the cached credentials (API keys, tokens) from the connector's logs or memory.
5. Attacker uses these credentials to access Crowdstrike APIs or other resources.

Vulnerable vs. Patched Code

No specific code snippets are available. The vulnerability is in the credential caching mechanism.

Vulnerable Behavior:

• Credentials are stored in a global cache accessible by all connectors in the same environment.
• No access control or encryption on the cache.

Patched Behavior (Hypothetical):

• Credentials are stored per connector with unique encryption keys.
• Cache is scoped to the connector's namespace.
• Access to cache requires authentication and authorization.

Exploitation & Lab Setup

Red Team

Objective: Extract cached Crowdstrike credentials from a shared environment.

Prerequisites:

• Access to a space where a Crowdstrike connector exists.
• Ability to create and run a new connector.

Steps:

1. Log in to the platform and navigate to the space.
2. Create a new Crowdstrike connector (e.g., "malicious-connector").
3. Configure the connector to log all environment variables and cache contents.
4. Run the connector and capture logs.
5. Extract credentials from logs (e.g., CROWDSTRIKE_API_KEY, CROWDSTRIKE_TOKEN).

Example Log Extraction (Hypothetical):

# After running the connector, check logs
cat /var/log/connector.log | grep -E "CROWDSTRIKE|API_KEY|TOKEN"

Blue Team

Detection:

• Monitor for creation of multiple Crowdstrike connectors in the same space.
• Alert on connectors that access credential caches without proper authorization.
• Use audit logs to track connector creation and credential access.

Mitigation:

• Isolate connectors into separate namespaces or spaces.
• Implement credential rotation and encryption.
• Restrict connector creation to trusted users.

Indicators of Compromise (IOCs)

• File Hashes: None available.
• Network Indicators: Unusual API calls to Crowdstrike endpoints from unexpected connectors.
• Log Entries: Connector logs containing CROWDSTRIKE_API_KEY or similar strings.
• Process Names: Connector processes reading credential cache files.

Detection Engineering

YARA Rule

rule CVE_2025_37728_Credential_Leak {
    meta:
        description = "Detects Crowdstrike credential leakage in connector logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-37728"
    strings:
        $cred1 = /CROWDSTRIKE_API_KEY\s*=\s*[A-Za-z0-9_\-]+/
        $cred2 = /CROWDSTRIKE_TOKEN\s*=\s*[A-Za-z0-9_\-]+/
        $cred3 = /crowdstrike.*credential/i
    condition:
        any of ($cred*)
}

Sigma Rule

title: Crowdstrike Connector Credential Leak
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential credential leakage from Crowdstrike connectors
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: crowdstrike_connector
detection:
    selection:
        EventID: 1001
        Message|contains: 
            - "CROWDSTRIKE_API_KEY"
            - "CROWDSTRIKE_TOKEN"
    condition: selection
falsepositives:
    - Legitimate connector initialization
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-37728 Crowdstrike Credential Leak"; flow:to_server; content:"CROWDSTRIKE_API_KEY"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Rotate all Crowdstrike API keys and tokens.
2. Review and restrict connector creation permissions.
3. Isolate connectors into separate spaces or namespaces.

Long-term Fix:

• Apply vendor patch when available.
• Implement credential vaulting with access controls.
• Enable audit logging for all connector operations.

Workarounds:

• Disable credential caching if possible.
• Use short-lived tokens.

Valters IT