CVE-2025-30474
📋 TL;DR
Apache Commons VFS versions before 2.10.0 can leak FTP passwords in error messages when file operations fail. This occurs because the FtpFileObject class includes the full URI (including credentials) in exception messages. Any application using Apache Commons VFS for FTP operations with embedded credentials is affected.
💻 Affected Systems
- Apache Commons VFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain FTP credentials from error logs or application output, potentially gaining unauthorized access to FTP servers and sensitive data.
Likely Case
Credentials exposed in application logs accessible to administrators or developers, leading to credential harvesting if logs are not properly secured.
If Mitigated
With proper log sanitization and access controls, exposure is limited to authorized personnel only.
🎯 Exploit Status
Exploitation requires access to error messages or logs containing the exception.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.0
Vendor Advisory: https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4
Restart Required: Yes
Instructions:
1. Identify applications using Apache Commons VFS. 2. Update dependency to version 2.10.0 or later. 3. Rebuild and redeploy applications. 4. Restart affected services.
🔧 Temporary Workarounds
Log sanitization
allConfigure application logging to filter or mask exception messages containing URIs.
Configure log4j/slf4j filters to redact patterns matching 'ftp://.*:.*@'
Disable detailed error messages
allConfigure applications to return generic error messages instead of detailed exceptions.
Set application error reporting to production mode
🧯 If You Can't Patch
- Implement strict access controls on application logs and error reporting endpoints.
- Use FTP connections without embedded credentials (e.g., external credential storage).
🔍 How to Verify
Check if Vulnerable:
Check Maven/Gradle dependencies or library versions for Apache Commons VFS < 2.10.0.Check Version:
Check build configuration files (pom.xml, build.gradle) or run: java -cp commons-vfs2.jar org.apache.commons.vfs2.VersionVerify Fix Applied:
Verify Apache Commons VFS version is 2.10.0 or higher in dependencies.📡 Detection & Monitoring
Log Indicators:
- Exception messages containing 'ftp://' with password patterns
- FtpFileObject exceptions in stack traces
Network Indicators:
- Unusual FTP connection attempts following error conditions
SIEM Query:
source="application.logs" AND "ftp://*:*@*"