CVE-2025-66361

Executive Summary

CVE-2025-66361 exposes a critical information disclosure vulnerability in Logpoint SIEM versions prior to 7.7.0. Under conditions of high CPU load, sensitive data—including credentials, API keys, and internal configuration details—becomes visible in the System Processes view for an extended period. This allows an authenticated attacker with process monitoring access to harvest secrets that could be used for lateral movement, privilege escalation, or data exfiltration. The vulnerability is rooted in Logpoint’s failure to properly sanitize process command-line arguments during resource-constrained states, leading to prolonged exposure of sensitive parameters.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a proprietary Logpoint SIEM component.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Local (AV:L) – Requires authenticated access to the Logpoint system.
• Attack Complexity (AC): Low (AC:L) – High CPU load is a common operational condition.
• Privileges Required (PR): Low (PR:L) – The attacker needs a low-privileged account with process viewing rights.
• User Interaction (UI): None (UI:N) – No user action beyond normal system operation.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (C:H) – Exposed secrets can lead to full system compromise.
• Integrity (I): Low (I:L) – Indirect impact via credential reuse.
• Availability (A): None (A:N) – No direct impact on availability.

Estimated CVSS Score: 5.5 (Medium) – However, the actual risk is higher due to the potential for credential harvesting.

Deep Dive & Mechanics

The vulnerability occurs in Logpoint’s process monitoring subsystem. When the system experiences high CPU load, the process listing mechanism (likely ps or a custom agent) fails to truncate or sanitize command-line arguments in a timely manner. Normally, sensitive data in process arguments (e.g., --password=secret) is cleared after a short interval. Under load, this cleanup is delayed, leaving secrets visible in the System Processes UI for an extended duration.

Root Cause: Inadequate resource management in the process argument sanitization routine. The routine relies on a timer that is starved during high CPU usage, preventing the redaction of sensitive fields.

Attack Scenario:

1. An attacker gains low-privileged access to the Logpoint web interface (e.g., via a compromised analyst account).
2. The attacker monitors the System Processes view during periods of high CPU load (which can be artificially induced by running CPU-intensive queries).
3. The attacker observes command-line arguments containing credentials, API tokens, or other secrets.
4. These secrets are then used to escalate privileges or access other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Logpoint < 7.7.0):

# Simplified representation of the vulnerable process listing
def get_process_list():
    processes = subprocess.check_output(['ps', 'aux']).decode()
    # No sanitization or delayed cleanup
    return processes

Patched Code (Logpoint >= 7.7.0):

# Patched version with forced sanitization
def get_process_list():
    processes = subprocess.check_output(['ps', 'aux']).decode()
    # Immediate redaction of sensitive patterns
    processes = re.sub(r'(--password|--token|--secret)=\S+', r'\1=***REDACTED***', processes)
    return processes

The patch ensures that sensitive data is redacted immediately, regardless of CPU load, by using a regex-based filter that runs synchronously.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Low-privileged Logpoint account with access to System Processes.
• Ability to induce high CPU load (e.g., run a heavy search query).

Steps:

1. Induce High CPU Load: Execute a resource-intensive Logpoint query (e.g., search * | stats count by source with a large time range).
2. Monitor Processes: Navigate to Administration > System Processes.
3. Harvest Secrets: Look for processes with command-line arguments containing --password, --api-key, --token, or similar patterns.
4. Exploit: Use harvested credentials to access other systems or escalate privileges.

Example Command (to induce load):

# Using Logpoint API to trigger a heavy search
curl -k -u "lowprivuser:password" -X POST "https://logpoint-server:8443/api/search" -d '{"query":"search * | stats count by source","time_range":"last_7d"}'

Blue Team

Detection:

• Monitor for unusual CPU spikes that correlate with process listing queries.
• Alert on repeated access to the System Processes page by low-privileged users.
• Use the Sigma rule below to detect credential harvesting attempts.

Mitigation:

• Immediately upgrade to Logpoint 7.7.0 or later.
• Restrict access to System Processes to only high-privileged administrators.
• Implement network segmentation to limit lateral movement from Logpoint.

Indicators of Compromise (IOCs)

• Process Names: logpoint-agent, logpoint-collector, logpoint-search
• Command-Line Patterns: --password=, --api-key=, --token=, --secret=
• Log Entries: Repeated access to /api/system/processes or similar endpoints.
• Network Traffic: Outbound connections from Logpoint to unexpected IPs using harvested credentials.

Detection Engineering

YARA Rule

rule CVE_2025_66361_Logpoint_Secret_Exposure {
    meta:
        description = "Detects Logpoint process listings containing exposed secrets"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66361"
    strings:
        $secret1 = /--password=\S+/ nocase
        $secret2 = /--api-key=\S+/ nocase
        $secret3 = /--token=\S+/ nocase
        $secret4 = /--secret=\S+/ nocase
        $process = "logpoint" nocase
    condition:
        any of ($secret*) and $process
}

Sigma Rule

title: Logpoint Sensitive Data Exposure via System Processes
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to harvest credentials from Logpoint System Processes view
author: Valters IT
logsource:
    product: logpoint
    service: web
detection:
    selection:
        EventID: 1001  # Example: Process listing event
        User: "lowpriv*"
        Action: "view_processes"
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66361 Logpoint Secret Harvesting"; flow:to_server,established; content:"/api/system/processes"; http_uri; nocase; content:"Authorization"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Logpoint version 7.7.0 or later.
2. Workaround: Restrict access to the System Processes view to only administrators.
3. Monitoring: Enable logging for all process listing API calls and alert on anomalies.
4. Credential Rotation: Rotate any credentials that may have been exposed.
5. Network Segmentation: Isolate Logpoint from critical systems to limit blast radius.

Valters IT
Securing Your Digital Frontier