CVE-2025-66360

Executive Summary

CVE-2025-66360 is a privilege escalation vulnerability affecting Logpoint SIEM solutions prior to version 7.7.0. The flaw stems from an improperly configured access control policy that exposes sensitive internal service information—specifically Redis—to users with the li-admin role. This exposure can be leveraged by an authenticated attacker to escalate privileges, potentially gaining unauthorized access to critical system components and data. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is significant due to the potential for lateral movement and data compromise within a Logpoint deployment. No public proof-of-concept (PoC) or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned/Placeholder)
• Attack Vector (AV): Network (likely, as Redis is network-accessible)
• Attack Complexity (AC): Low (default Redis configurations often lack authentication)
• Privileges Required (PR): Low (requires li-admin role)
• User Interaction (UI): None
• Scope (S): Changed (privilege escalation)
• Confidentiality (C): High (exposure of sensitive data)
• Integrity (I): High (potential to modify Redis data)
• Availability (A): High (potential to disrupt Redis service)

Threat Level: High. While the CVSS score is 0.0, the actual risk is elevated due to the ease of exploitation (low complexity, low privileges required) and the high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability resides in Logpoint's access control policies for internal services. Logpoint uses Redis as a caching and session management layer. In versions prior to 7.7.0, the access control policy for the Redis service was misconfigured, allowing users with the li-admin role to query Redis directly. This is a violation of the principle of least privilege, as li-admin users should not have direct access to internal infrastructure components.

Attack Flow:

1. An attacker authenticates as a user with the li-admin role.
2. The attacker discovers the Redis endpoint (e.g., via configuration files, environment variables, or network scanning).
3. The attacker connects to Redis (typically on TCP port 6379) using a Redis client.
4. The attacker executes Redis commands (e.g., KEYS *, GET, CONFIG GET) to extract sensitive data, such as session tokens, application secrets, or configuration parameters.
5. Using the extracted data, the attacker escalates privileges (e.g., by forging session tokens or accessing other services).

Root Cause: Improper access control policy configuration in Logpoint's internal service mesh or RBAC system.

Vulnerable vs. Patched Code

Vulnerable (Pre-7.7.0): The access control policy for Redis is either missing or overly permissive. For example, a policy might allow all li-admin users to connect to Redis without additional authentication or authorization checks.

# Vulnerable pseudo-code
if user.role == "li-admin":
    allow_access_to_redis()  # No further checks

Patched (7.7.0+): The access control policy is tightened to restrict Redis access to only authorized system services or specific administrative roles.

# Patched pseudo-code
if user.role == "li-admin" and user.has_special_permission("redis_access"):
    allow_access_to_redis()
else:
    deny_access()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Logpoint instance (version < 7.7.0) with a user account that has the li-admin role.
• Network connectivity to the Redis service (default port 6379).

Exploitation Steps:

1. Discover Redis Endpoint:

   • Check Logpoint configuration files (e.g., /opt/logpoint/conf/redis.conf) or environment variables.
   • Use network scanning (e.g., nmap -p 6379 <target>).

2. Connect to Redis:

   redis-cli -h <redis_host> -p 6379
   

3. Extract Sensitive Data:

   # List all keys
   KEYS *
   
   # Get a specific key (e.g., session token)
   GET session:abc123
   
   # Get Redis configuration
   CONFIG GET *
   

4. Escalate Privileges:

   • Use extracted session tokens to impersonate other users.
   • Modify Redis data to gain administrative access.

Blue Team

Detection:

• Monitor for unauthorized Redis connections from li-admin users.
• Alert on unusual Redis commands (e.g., KEYS *, CONFIG GET).
• Review Logpoint access logs for policy violations.

Mitigation:

• Immediately upgrade to Logpoint 7.7.0 or later.
• If upgrade is not possible, restrict network access to Redis using firewall rules.
• Implement additional authentication for Redis (e.g., requirepass).
• Audit li-admin user activities.

Indicators of Compromise (IOCs)

• Network: Unauthorized connections to Redis port 6379 from li-admin user IPs.
• Logs: Logpoint audit logs showing access to Redis configuration or data.
• Redis: Presence of unexpected keys or modified data.
• File: Suspicious entries in Logpoint configuration files (e.g., exposed Redis credentials).

Detection Engineering

YARA Rule

rule CVE_2025_66360_Redis_Exposure {
    meta:
        description = "Detects Logpoint Redis exposure indicators"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66360"
    strings:
        $redis_cmd = "KEYS *" ascii wide nocase
        $redis_config = "CONFIG GET" ascii wide nocase
        $redis_auth = "AUTH" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66360 - Logpoint Redis Exposure
id: cve-2025-66360-redis-exposure
status: experimental
description: Detects unauthorized Redis access from li-admin users
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: logpoint
detection:
    selection:
        user.role: "li-admin"
        destination.port: 6379
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 6379 (msg:"CVE-2025-66360 - Logpoint Redis Exposure"; flow:to_server; content:"KEYS"; nocase; content:"CONFIG"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Logpoint to version 7.7.0 or later.
2. Network Segmentation: Restrict access to Redis port 6379 to only trusted hosts.
3. Redis Authentication: Enable requirepass in Redis configuration.
4. Access Control Review: Audit and tighten RBAC policies for li-admin users.

Long-Term Measures:

• Implement regular security audits of access control policies.
• Use a secrets management solution to store Redis credentials.
• Enable logging and monitoring for all internal service access.

Valters IT
Securing Your Digital Frontier