CVE-2025-54380
📋 TL;DR
Opencast versions before 17.6 incorrectly send hashed global system account credentials to attacker-controlled URLs when fetching mediapackage elements. This allows authenticated users with ingest permissions to exfiltrate credential hashes. The vulnerability affects all Opencast deployments using affected versions.
💻 Affected Systems
- Opencast
📦 What is this software?
Opencast by Apereo
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain hashed system credentials, potentially enabling credential cracking and full system compromise leading to data theft, service disruption, or lateral movement.
Likely Case
Credential hash exfiltration requiring offline cracking attempts; successful cracking could lead to unauthorized system access.
If Mitigated
With proper network segmentation and credential rotation, impact is limited to credential hash exposure without immediate system access.
🎯 Exploit Status
Exploitation requires authenticated user with ingest permissions; simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.6
Vendor Advisory: https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Stop Opencast service. 3. Upgrade to Opencast 17.6 or later. 4. Restart Opencast service. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict Ingest Permissions
allLimit users with ingest permissions to trusted personnel only.
Network Segmentation
allRestrict outbound connections from Opencast servers to only trusted domains.
🧯 If You Can't Patch
- Rotate all system account credentials immediately
- Implement strict network egress filtering and monitor for credential exfiltration attempts
🔍 How to Verify
Check if Vulnerable:
Check Opencast version; if below 17.6, system is vulnerable if using mediapackage functionality.Check Version:
Check Opencast admin interface or configuration files for version information.Verify Fix Applied:
Confirm Opencast version is 17.6 or higher and test mediapackage functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Opencast to unfamiliar domains
- Failed authentication attempts with system accounts
Network Indicators:
- HTTP POST/GET requests containing credential hashes to external domains
- Unusual traffic patterns from Opencast server
SIEM Query:
source="opencast" AND (url="*org.opencastproject.security.digest*" OR event="credential_leak")