Xorux LPAR2RRD CVE-2025-5498: Read-Only User Privilege Escalation to Download Logs

Critical Vulnerability Information 1. Vulnerability Details Hash: SHA256 ID: KL-001-2025 015 Title: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information Affected Vendor: Xorux Affected Product: LPAR2RRD Affected Versions: 8.00 and earlier CVE ID: CVE-2025-5498 CWE Classification: CWE-648: Incorrect Use of Privileged APIs 2. Vulnerability Description An API endpoint intended for access only by web application administrators can be accessed by read-only level users. This endpoint allows log downloads, exposing sensitive information. 3. Technical Description Read-only users can access a web application endpoint used for downloading logs. These logs are stored in .tar.gz format and contain sensitive information such as password hashes, which should not be accessible to read-only users. Attackers can exploit this vulnerability to obtain and attempt to crack password hashes, including those of administrator accounts. 4. Mitigation and Remediation Recommendations Xorux has released version 8.05, which includes a fix for this vulnerability. For more details: http://lpar2rrd.com/nots800.php 5. Acknowledgments This vulnerability was discovered by Jim Becher of Korelogic, Inc. 6. Disclosure Timeline 2025-07-17: Korelogic requested contact point to report the vulnerability securely. 2025-07-18: Vendor provided support@xorux.com as contact point. 2025-07-21: Korelogic sent four additional findings to Xorux. 2025-07-23: Vendor notified that the issue was fixed and a new version would be released on July 25, 2025. 2025-07-25: Xorux released an updated version for the affected product. 2025-07-28: Korelogic publicly disclosed the vulnerability. 7. Proof of Concept A curl command example is provided, demonstrating how to exploit the vulnerability to download log files and extract sensitive information such as password hashes.

Goal Reached Thanks to every supporter — we hit 100%!

Xorux LPAR2RRD CVE-2025-5498: Read-Only User Privilege Escalation to Download Logs