CVE-2022-25512
📋 TL;DR
FreeTAKServer-UI v1.9.8 leaks sensitive API and Websocket keys, potentially exposing authentication credentials and allowing unauthorized access to server functionality. This affects all deployments using the vulnerable version of FreeTAKServer-UI.
💻 Affected Systems
- FreeTAKServer-UI
📦 What is this software?
Freetakserver Ui by Freetakserver Ui Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain API/Websocket keys and gain full administrative control over the FreeTAKServer instance, potentially compromising the entire TAK ecosystem and sensitive location/communication data.
Likely Case
Unauthorized users access server APIs to view sensitive data, manipulate server operations, or disrupt TAK communications.
If Mitigated
Limited exposure of non-critical configuration data with no access to sensitive operations due to proper network segmentation and authentication controls.
🎯 Exploit Status
Exploitation requires access to the exposed keys, which are leaked in the UI. No authentication needed once keys are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.9.9 or later
Vendor Advisory: https://github.com/FreeTAKTeam/UI/issues/26
Restart Required: Yes
Instructions:
1. Update FreeTAKServer-UI to v1.9.9 or later. 2. Regenerate all API and Websocket keys. 3. Restart the FreeTAKServer-UI service.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict access to FreeTAKServer-UI interface to trusted networks only
iptables -A INPUT -p tcp --dport [UI_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [UI_PORT] -j DROP
Key Rotation
allManually regenerate and update API/Websocket keys in configuration
# Edit configuration files to replace leaked keys with new secure keys
# Restart FreeTAKServer-UI service
🧯 If You Can't Patch
- Immediately rotate all API and Websocket keys and monitor for unauthorized access
- Isolate the FreeTAKServer-UI component behind a firewall with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if FreeTAKServer-UI version is 1.9.8 and inspect configuration files for exposed API/Websocket keysCheck Version:
Check package version or inspect UI interface footer/version informationVerify Fix Applied:
Verify version is 1.9.9 or later and confirm keys are properly secured in configuration📡 Detection & Monitoring
Log Indicators:
- Unauthorized API access attempts
- Unexpected key usage patterns
- Access from unauthorized IP addresses
Network Indicators:
- Unusual API call patterns
- Websocket connections from unexpected sources
- Traffic to sensitive endpoints without proper authentication
SIEM Query:
source="freetakserver-ui" AND (event="unauthorized_access" OR event="api_key_usage")