CVE-2025-62513

Executive Summary

CVE-2025-62513 is a medium-severity information disclosure vulnerability affecting OpenBao, an open-source identity-based secrets management system. The flaw resides in the audit logging subsystem, where a regression introduced between versions 2.2.0 and 2.4.1 causes raw HTTP bodies to be logged without proper redaction (HMAC). This exposes sensitive data, including short-lived ACME verification challenge codes and OIDC authentication/token response codes and claims, to anyone with access to the audit logs. While ACME codes are time-limited, OIDC tokens and claims can be reused for unauthorized access. The vulnerability is patched in OpenBao 2.4.2.

Supply Chain & Package Security

OpenBao is a Go-based project. The vulnerability does not directly affect the supply chain (e.g., dependency poisoning), but the exposure of OIDC tokens in audit logs could lead to downstream compromise of systems relying on those tokens. Organizations using OpenBao as an identity provider should treat this as a critical supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: Low (exposure of sensitive data)
• Integrity: None
• Availability: None
• Threat Level: Medium – Exploitation requires access to audit logs, but the data leaked (OIDC tokens) can be used for lateral movement.

Deep Dive & Mechanics

The vulnerability is a regression in the audit log redaction logic. In OpenBao, sensitive fields in HTTP request/response bodies are supposed to be HMAC'd (hashed) before being written to the audit log. However, due to a coding error, certain endpoints (ACME for PKI and OIDC issuer for identity) bypass this redaction, logging raw values.

• Affected Endpoints:
  • ACME challenge verification endpoints (PKI subsystem)
  • OIDC authentication and token endpoints (identity subsystem)
• Root Cause: The redaction function was not applied to the raw HTTP body for these specific endpoints, likely due to a missing call or incorrect conditional logic.
• Impact: An attacker with read access to the audit logs (e.g., a compromised admin account or insider threat) can extract:
  • ACME verification codes (short-lived, but could be used to re-challenge)
  • OIDC authorization codes, access tokens, ID tokens, and user claims (long-lived, enabling account takeover)

Vulnerable vs. Patched Code

Vulnerable (OpenBao 2.2.0 - 2.4.1):

// In audit logging middleware
func logRequest(req *http.Request) {
    body, _ := ioutil.ReadAll(req.Body)
    // BUG: No redaction applied for ACME/OIDC endpoints
    auditLog.Write(body)
}

Patched (OpenBao 2.4.2):

func logRequest(req *http.Request) {
    body, _ := ioutil.ReadAll(req.Body)
    if isSensitiveEndpoint(req.URL.Path) {
        body = hmacSensitiveFields(body)
    }
    auditLog.Write(body)
}

The patch adds a check for sensitive endpoints (ACME, OIDC) and applies HMAC redaction to the body before logging.

Exploitation & Lab Setup

Red Team

Prerequisites: Access to OpenBao audit logs (e.g., via compromised admin credentials or log aggregation system).

Exploitation Steps:

1. Identify audit log entries containing ACME or OIDC requests.
2. Extract raw HTTP bodies from log entries.
3. For ACME: Use the verification code to re-challenge or monitor challenge status.
4. For OIDC: Use the authorization code to exchange for tokens, or directly use leaked access tokens.

Example (OIDC token extraction):

# Simulate extracting OIDC token from audit log
grep "oidc" /var/log/openbao/audit.log | jq '.request.body'

Blue Team

Detection:

• Monitor for unusual access to audit log files (e.g., audit.log).
• Alert on any process reading audit logs outside of normal SIEM ingestion.
• Use the YARA/Sigma rules below to detect exploitation attempts.

Hunting:

• Search audit logs for patterns of raw OIDC tokens (e.g., eyJ base64 strings).
• Correlate ACME challenge codes with subsequent certificate issuance.

Indicators of Compromise (IOCs)

• File: /var/log/openbao/audit.log (or custom audit log path)
• Pattern: Raw JWT tokens (base64-encoded JSON) in audit log entries
• Pattern: ACME challenge codes (e.g., challenge-abc123)
• Network: Unusual outbound connections from OpenBao server to OIDC providers (if tokens are exfiltrated)

Detection Engineering

YARA Rule

rule CVE_2025_62513_AuditLog_Leak {
    meta:
        description = "Detects raw OIDC tokens or ACME codes in OpenBao audit logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62513"
    strings:
        $oidc_token = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/  // JWT pattern
        $acme_code = /challenge-[a-f0-9]{32}/  // ACME challenge code pattern
    condition:
        any of them
}

Sigma Rule

title: OpenBao Audit Log Sensitive Data Leak
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects raw OIDC tokens or ACME codes in OpenBao audit logs
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62513
author: Valters IT
date: 2025-04-10
logsource:
    product: openbao
    service: audit
detection:
    selection:
        - EventID: 1  # Assuming audit log event ID
        - Data|re: 'eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'  # JWT
        - Data|re: 'challenge-[a-f0-9]{32}'  # ACME code
    condition: selection
falsepositives:
    - Legitimate HMAC'd values (unlikely to match raw JWT)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-62513 OpenBao Audit Log Leak - OIDC Token Exfiltration"; flow:to_server; content:"eyJ"; http_client_body; pcre:"/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/R"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade OpenBao to version 2.4.2 or later.
2. Rotate all OIDC tokens and ACME challenge codes that may have been logged.
3. Review audit logs for any leaked tokens and revoke them.

Long-term:

• Implement strict access controls on audit logs (e.g., read-only for SIEM, no direct human access).
• Enable audit log encryption at rest.
• Monitor for unauthorized access to audit logs.

Workaround (if patching is delayed):

• Disable ACME and OIDC functionality temporarily.
• Use a log shipper that redacts sensitive patterns before storage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert