CVE-2025-62513
📋 TL;DR
OpenBao versions 2.2.0 to 2.4.1 have an audit log regression where raw HTTP bodies for certain endpoints aren't properly redacted. This leaks ACME verification challenge codes and OIDC auth/token response codes with claims in audit logs. Organizations using OpenBao's ACME PKI functionality or OIDC identity subsystem are affected.
💻 Affected Systems
- OpenBao
📦 What is this software?
Openbao by Openbao
⚠️ Risk & Real-World Impact
Worst Case
Attackers with access to audit logs could obtain ACME verification codes before expiry or OIDC auth/token codes, potentially enabling unauthorized certificate issuance or identity impersonation.
Likely Case
Sensitive authentication codes and claims are exposed in audit logs, allowing privileged insiders or attackers with log access to view sensitive authentication data.
If Mitigated
With proper log access controls and short code expiry times, the impact is limited to temporary exposure of time-sensitive authentication data.
🎯 Exploit Status
Exploitation requires access to audit logs, which typically requires some level of system access or privilege.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.2
Vendor Advisory: https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8
Restart Required: Yes
Instructions:
1. Backup OpenBao configuration and data. 2. Download OpenBao 2.4.2 from official repository. 3. Stop OpenBao service. 4. Replace binary with patched version. 5. Restart OpenBao service. 6. Verify service is running correctly.
🔧 Temporary Workarounds
Disable affected functionality
allTemporarily disable ACME PKI or OIDC identity subsystem features until patching is possible.
Restrict audit log access
allImplement strict access controls on audit log storage and viewing to limit exposure.
🧯 If You Can't Patch
- Implement strict access controls on audit log storage and viewing
- Monitor audit logs for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check OpenBao version using 'openbao version' command and verify if between 2.2.0 and 2.4.1 inclusive.Check Version:
openbao versionVerify Fix Applied:
After patching, verify version is 2.4.2 or higher using 'openbao version' command.📡 Detection & Monitoring
Log Indicators:
- Unredacted ACME challenge codes or OIDC auth/token codes in audit logs
- Sensitive claims data in audit logs
Network Indicators:
- Unauthorized access attempts to audit log storage
SIEM Query:
source="openbao-audit" AND (message="*challenge*" OR message="*token*" OR message="*auth*")