CVE-2025-66910

Executive Summary

CVE-2025-66910 identifies a critical security vulnerability in the Turms Server (v0.10.0-SNAPSHOT and earlier) related to the insecure storage of administrator passwords. The vulnerability resides in the BaseAdminService class, which caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login, the raw password is stored unencrypted in memory in the rawPassword field. This design flaw allows an attacker with local system access to extract these passwords through memory dumps, heap analysis, or debugger attachment, effectively bypassing the bcrypt password hashing protection.

The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information) and has a CVSS v3.1 base score of 5.5 (Medium), with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The attack vector is local, requiring low privileges and no user interaction. The confidentiality impact is high, as plaintext passwords can be extracted, but there is no impact on integrity or availability.

Supply Chain & Package Security

This vulnerability is specific to the Turms Server application, which is a Java-based open-source instant messaging platform. The vulnerability is not related to any third-party package manager (NPM, PyPI, Go, Ruby) but is inherent to the application's own codebase. The risk is primarily to organizations that deploy and manage Turms Server instances, as an attacker with local access to the server can extract administrator credentials.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - No special conditions or race conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs low-level privileges (e.g., a standard user account) to perform memory dumps or attach a debugger.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the security scope of the vulnerable component.
• Confidentiality (C): High (H) - Complete loss of confidentiality, as plaintext passwords are exposed.
• Integrity (I): None (N) - No impact on data integrity.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is medium, the actual risk is elevated in environments where local access is possible (e.g., shared hosting, compromised containers, or insider threats). The extraction of administrator passwords can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the BaseAdminService class of the Turms Server. The class is responsible for authenticating administrators. To optimize performance, it caches AdminInfo objects in memory. The AdminInfo object contains a rawPassword field that stores the plaintext password provided during login.

Normal Authentication Flow:

1. An administrator provides a username and password.
2. The BaseAdminService retrieves the stored bcrypt hash for the user.
3. It compares the provided password against the bcrypt hash.
4. Upon successful authentication, the AdminInfo object is created or updated, and the raw password is stored in the rawPassword field for caching purposes.

Vulnerability:

• The rawPassword field is never cleared or nullified after authentication.
• The AdminInfo object remains in memory for the duration of the server's runtime.
• An attacker with local access can use tools like jmap, jstack, or a debugger to dump the heap and extract the rawPassword field from the AdminInfo objects.

Attack Scenario:

1. Attacker gains low-privilege access to the Turms Server host (e.g., via SSH, container escape, or malicious insider).
2. Attacker identifies the Java process ID (PID) of the Turms Server.
3. Attacker uses jmap -dump:live,format=b,file=heap.bin <PID> to dump the heap.
4. Attacker analyzes the heap dump using tools like Eclipse MAT or jhat to find AdminInfo objects.
5. Attacker extracts the rawPassword field, obtaining the plaintext administrator password.
6. Attacker uses the password to authenticate as an administrator and gain full control of the Turms Server.

Vulnerable vs. Patched Code

Vulnerable Code (Turms Server v0.10.0-SNAPSHOT and earlier):

// BaseAdminService.java (simplified)
public class BaseAdminService {
    private Map<String, AdminInfo> adminCache = new ConcurrentHashMap<>();

    public boolean authenticate(String username, String password) {
        // Retrieve stored hash
        String storedHash = getStoredHash(username);
        if (BCrypt.checkpw(password, storedHash)) {
            // Vulnerable: storing plaintext password in cache
            AdminInfo info = new AdminInfo(username, password); // password stored in rawPassword
            adminCache.put(username, info);
            return true;
        }
        return false;
    }
}

// AdminInfo.java (simplified)
public class AdminInfo {
    private String username;
    private String rawPassword; // Plaintext password stored here

    public AdminInfo(String username, String rawPassword) {
        this.username = username;
        this.rawPassword = rawPassword;
    }

    public String getRawPassword() {
        return rawPassword;
    }
}

Patched Code (Hypothetical Fix):

// BaseAdminService.java (patched)
public class BaseAdminService {
    private Map<String, AdminInfo> adminCache = new ConcurrentHashMap<>();

    public boolean authenticate(String username, String password) {
        String storedHash = getStoredHash(username);
        if (BCrypt.checkpw(password, storedHash)) {
            // Patched: Do not store plaintext password
            AdminInfo info = new AdminInfo(username); // No password parameter
            adminCache.put(username, info);
            return true;
        }
        return false;
    }
}

// AdminInfo.java (patched)
public class AdminInfo {
    private String username;
    // rawPassword field removed entirely

    public AdminInfo(String username) {
        this.username = username;
    }
}

Key Differences:

• The vulnerable code stores the plaintext password in the AdminInfo object.
• The patched code removes the rawPassword field entirely and does not store the password after authentication.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the Turms Server host (e.g., SSH, container shell).
• Java Development Kit (JDK) installed (for jmap and jhat).
• Turms Server v0.10.0-SNAPSHOT or earlier running.

Steps:

1. Identify the Java Process:

   ps aux | grep turms
   

   Note the PID (e.g., 12345).

2. Dump the Heap:

   jmap -dump:live,format=b,file=heap.bin 12345
   

3. Analyze the Heap Dump: Use Eclipse MAT or jhat to search for AdminInfo objects.

   jhat heap.bin
   

   Open http://localhost:7000 in a browser. Navigate to the OQL (Object Query Language) console and run:

   select a.rawPassword from com.turms.server.admin.AdminInfo a
   

4. Extract Passwords: The OQL query will return the plaintext passwords stored in the rawPassword field.

Alternative Method (Debugger):

• Attach a debugger (e.g., jdb) to the running process and inspect the adminCache map.

Blue Team (Defense & Detection)

Detection:

• Monitor for the use of jmap, jstack, or other heap dump tools on production systems.
• Alert on unusual Java process activity or debugger attachments.
• Use endpoint detection and response (EDR) tools to detect memory dumping.

Mitigation:

• Apply the patch as soon as it becomes available.
• As a workaround, modify the BaseAdminService class to not store the plaintext password in the AdminInfo object.
• Restrict local access to the Turms Server host using strict access controls and least privilege principles.
• Use runtime application self-protection (RASP) tools to prevent memory dumping.
• Encrypt the heap dump files if they must be created for debugging.

Indicators of Compromise (IOCs)

• Process Anomalies: Unexpected execution of jmap, jstack, jhat, or jdb on the Turms Server host.
• File Artifacts: Presence of heap dump files (e.g., heap.bin, *.hprof) in the server's file system.
• Network Connections: Unusual outbound connections from the server to unknown IPs (potential exfiltration of heap dumps).
• Log Entries: Authentication logs showing successful logins from unexpected IPs or users after a heap dump event.
• Memory Analysis: Detection of AdminInfo objects with non-null rawPassword fields in memory.

Detection Engineering

YARA Rule

rule CVE_2025_66910_Turms_Plaintext_Password {
    meta:
        description = "Detects heap dump files containing plaintext passwords from Turms Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66910"
        hash = "sha256:examplehash"
    strings:
        $s1 = "AdminInfo" ascii wide nocase
        $s2 = "rawPassword" ascii wide nocase
        $s3 = "com.turms.server.admin" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Detection of Heap Dump Tools on Turms Server
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the execution of heap dump tools (jmap, jhat) on a Turms Server host, indicating potential exploitation of CVE-2025-66910.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66910
logsource:
    category: process_creation
    product: windows
    service: null
detection:
    selection:
        Image|endswith:
            - '\jmap.exe'
            - '\jhat.exe'
            - '\jstack.exe'
            - '\jdb.exe'
        CommandLine|contains:
            - 'dump'
            - 'heap'
    condition: selection
falsepositives:
    - Legitimate debugging activities by authorized personnel
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - cve.2025.66910

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66910 - Potential Exfiltration of Heap Dump from Turms Server"; flow:to_server,established; content:"heap.bin"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Patch: Monitor the Turms project for an official patch. If available, apply it immediately.
2. Workaround: If no patch is available, modify the source code to remove the rawPassword field from AdminInfo and ensure passwords are not cached in plaintext.
3. Restrict Access: Limit local access to the Turms Server host to only trusted administrators.
4. Monitor: Enable logging and monitoring for heap dump tool usage.

Long-Term Measures:

• Implement runtime application self-protection (RASP) to prevent memory dumping.
• Use secure coding practices to avoid storing sensitive data in memory.
• Conduct regular security audits and penetration testing.
• Educate developers on the risks of caching plaintext credentials.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.
For questions or further analysis, contact: security@valters-it.com