CVE-2025-56499
📋 TL;DR
This vulnerability in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges by extracting the external control key from the configuration file. This affects all systems running the vulnerable version of mihomo where authenticated users have access to configuration files.
💻 Affected Systems
- mihomo
📦 What is this software?
Mihomo by Metacubex
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or credentials, potentially leading to full system compromise through privilege escalation.
Likely Case
Unauthorized reading of configuration files, application data, or other files accessible to the elevated privileges of the mihomo process.
If Mitigated
Limited to reading files within the mihomo process's privilege scope, but still represents a significant information disclosure risk.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of configuration file location. The GitHub reference provides technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest mihomo releases after v1.19.11
Vendor Advisory: https://github.com/MetaCubeX/mihomo
Restart Required: Yes
Instructions:
1. Check mihomo GitHub repository for latest release. 2. Update to patched version. 3. Restart mihomo service. 4. Verify configuration files are properly secured.
🔧 Temporary Workarounds
Restrict configuration file permissions
linuxLimit read access to mihomo configuration files to only necessary users and processes
chmod 600 /path/to/mihomo/config
chown root:root /path/to/mihomo/config
Implement strict access controls
allEnsure only authorized users can access systems running mihomo and limit their privileges
🧯 If You Can't Patch
- Implement strict file system permissions on configuration files and sensitive directories
- Monitor for unauthorized access attempts to mihomo configuration files and audit user activities
🔍 How to Verify
Check if Vulnerable:
Check mihomo version: mihomo --version or check installed package version. If version is v1.19.11, system is vulnerable.Check Version:
mihomo --versionVerify Fix Applied:
Update to latest version and verify version is newer than v1.19.11. Test that authenticated users cannot read arbitrary files via mihomo.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to configuration files
- Unexpected file read operations by mihomo process
- Authentication logs showing suspicious user activity
Network Indicators:
- Unusual outbound connections from mihomo host
- Suspicious authentication patterns to mihomo services
SIEM Query:
process_name:"mihomo" AND file_read:"config" OR process_name:"mihomo" AND user_privilege_escalation