CVE-2025-47730
📋 TL;DR
This CVE describes a hardcoded credential vulnerability in TeleMessage's archiving backend that accepts API calls with static username 'logfile' and password 'enRR8UVVywXYbFkqU#QDPRkO' for authentication token requests. This allows attackers to obtain authentication tokens and potentially access archived communications. Organizations using TeleMessage's archiving backend through May 5, 2025 are affected.
💻 Affected Systems
- TeleMessage archiving backend
- TM SGNL (Archive Signal) app
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain authentication tokens and access archived sensitive communications, potentially including private messages, attachments, and metadata from Signal-clone applications.
Likely Case
Unauthorized access to archived communications, potential data exfiltration, and privacy violations for users of affected archiving systems.
If Mitigated
Limited impact if proper network segmentation, API monitoring, and credential rotation are implemented, though the hardcoded credentials remain a persistent risk.
🎯 Exploit Status
The hardcoded credentials are publicly available in source code, making exploitation trivial. The Signal-clone app shutdown suggests active exploitation concerns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Contact TeleMessage for updated versions after May 5, 2025. Consider disabling or replacing the affected archiving system.
🔧 Temporary Workarounds
Block API endpoints
linuxBlock access to authentication token API endpoints at network perimeter
iptables -A INPUT -p tcp --dport [API_PORT] -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="[API_PORT]" protocol="tcp" reject'
Implement API gateway authentication
allAdd additional authentication layer before TeleMessage API
🧯 If You Can't Patch
- Immediately rotate all authentication tokens and credentials in the system
- Implement strict network segmentation to isolate the TeleMessage backend from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if TeleMessage archiving backend accepts API calls with username 'logfile' and password 'enRR8UVVywXYbFkqU#QDPRkO' for authentication tokensCheck Version:
Check TeleMessage backend version and confirm it's newer than 2025-05-05Verify Fix Applied:
Verify that the hardcoded credentials no longer work for authentication and that proper credential management is implemented📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with username 'logfile'
- API calls to authentication token endpoints from unexpected sources
- Unusual access patterns to archived communications
Network Indicators:
- Traffic to TeleMessage API endpoints with hardcoded credential patterns
- Authentication token requests from unauthorized IPs
SIEM Query:
source="telemessage*" AND (user="logfile" OR password="*enRR8UVVywXYbFkqU#QDPRkO*")🔗 References
- https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/
- https://github.com/micahflee/TM-SGNL-Android/blob/bd7ccbb8bc79193fc4c57cae7cc1051e6250fa89/app/src/tm/java/org/archiver/ArchiveConstants.kt#L45-L46
- https://news.ycombinator.com/item?id=43909220
- https://www.theregister.com/2025/05/05/telemessage_investigating/
