CVE-2025-24807
📋 TL;DR
This vulnerability in eprosima Fast DDS allows expired Permissions Certificate Authorities (PermissionsCA) to be accepted as valid due to insufficient validation of certificate chains and expiration dates. The access control plugin only validates S/MIME signatures, potentially allowing governance/permissions from expired certificates. Systems using Fast DDS with security plugins enabled are affected.
💻 Affected Systems
- eprosima Fast DDS
📦 What is this software?
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
⚠️ Risk & Real-World Impact
Worst Case
System crash when PermissionsCA is not self-signed and contains full-chain, potentially causing denial of service in DDS-based communication systems.
Likely Case
Expired PermissionsCA certificates being accepted as valid, potentially allowing unauthorized access control configurations to persist beyond intended validity periods.
If Mitigated
Minimal impact if proper certificate lifecycle management is implemented and systems are isolated from untrusted networks.
🎯 Exploit Status
Exploitation requires ability to manipulate certificate validation process and knowledge of target DDS security configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, or 3.2.0
Vendor Advisory: https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-w33g-jmm2-8983
Restart Required: Yes
Instructions:
1. Identify your Fast DDS version. 2. Upgrade to the appropriate patched version for your release line. 3. Restart all Fast DDS applications. 4. Verify certificate validation is working correctly.
🔧 Temporary Workarounds
Disable security plugins
allTemporarily disable Fast DDS security plugins if they are not essential for your deployment
Configure Fast DDS without security plugins enabled
Use self-signed PermissionsCA
allConfigure PermissionsCA certificates to be self-signed to avoid the crash scenario
Ensure all PermissionsCA certificates are self-signed
🧯 If You Can't Patch
- Implement strict certificate lifecycle management with manual expiration monitoring
- Isolate Fast DDS deployments from untrusted networks and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check Fast DDS version and verify if security plugins with PermissionsCA are enabled in configurationCheck Version:
Check Fast DDS library version or application output for version informationVerify Fix Applied:
Test with expired PermissionsCA certificate - it should be rejected after patch📡 Detection & Monitoring
Log Indicators:
- Certificate validation errors
- Security plugin initialization failures
- Unexpected certificate acceptance
Network Indicators:
- Unusual DDS security handshake patterns
- Certificate validation bypass attempts
SIEM Query:
Search for Fast DDS security plugin errors or certificate validation warnings in application logs🔗 References
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L390-L396
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L412
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/authentication/PKIDH.cpp#L241
- https://github.com/eProsima/Fast-DDS/pull/5530
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-w33g-jmm2-8983
- https://www.omg.org/spec/DDS-SECURITY/1.1/PDF
