CVE-2025-52493
📋 TL;DR
PagerDuty Runbook exposes stored secrets in the webpage DOM on configuration pages, allowing administrative users to view masked passwords by changing input field types using browser developer tools. This information disclosure vulnerability affects administrative users with access to configuration pages in PagerDuty Runbook versions through 2025-06-12.
💻 Affected Systems
- PagerDuty Runbook
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrative users could exfiltrate all stored secrets (API keys, passwords, tokens) from the system, leading to complete compromise of integrated systems and data breaches.
Likely Case
Administrative users accidentally or intentionally view sensitive credentials they shouldn't have access to, potentially violating least privilege principles and audit requirements.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrative users who already have high privileges, though it violates security best practices.
🎯 Exploit Status
Exploitation requires administrative access to the configuration page. The technique is simple: open browser developer tools, locate password fields, and change input type from 'password' to 'text'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2025-06-12
Vendor Advisory: https://www.pagerduty.com/security/disclosure/
Restart Required: No
Instructions:
1. Upgrade PagerDuty Runbook to version after 2025-06-12. 2. Verify the fix by checking that secrets are no longer exposed in page source. 3. Rotate any potentially exposed credentials as precaution.
🔧 Temporary Workarounds
Restrict Configuration Page Access
allLimit access to configuration pages to only absolutely necessary administrative users using role-based access controls.
Browser Security Policies
allImplement Content Security Policies and disable developer tools access for administrative users where possible.
🧯 If You Can't Patch
- Implement strict access controls to limit which administrators can view configuration pages
- Monitor and audit all access to configuration pages and investigate any unusual activity
🔍 How to Verify
Check if Vulnerable:
1. Log in as administrator. 2. Navigate to a configuration page with password fields. 3. Open browser developer tools (F12). 4. Inspect password input elements - if 'value' attribute contains the actual secret, the system is vulnerable.Check Version:
Check PagerDuty Runbook version in admin interface or via API endpoint /api/versionVerify Fix Applied:
Repeat the vulnerable check - password fields should not contain the actual secret value in the DOM, only placeholder or masked values.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to configuration pages
- Multiple failed attempts to access configuration interfaces
Network Indicators:
- Unusual outbound connections from administrative workstations following configuration page access
SIEM Query:
source="pagerduty_logs" AND (event="config_page_access" OR event="admin_activity") AND user_role="admin" AND resource_type="secret"