CVE-2025-64299
📋 TL;DR
LogStare Collector contains an information disclosure vulnerability where administrative users can access other users' password hashes. This affects all LogStare Collector deployments with administrative user accounts. While password hashes are not plaintext passwords, they could potentially be cracked offline.
💻 Affected Systems
- LogStare Collector
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrative user with malicious intent could extract all password hashes, crack them offline, and gain unauthorized access to user accounts, potentially leading to privilege escalation or lateral movement.
Likely Case
Accidental exposure of password hashes to legitimate administrators during normal operations, or targeted extraction by a compromised administrative account.
If Mitigated
Limited to authorized administrative users only, with strong password policies making hash cracking difficult and proper monitoring detecting unusual access patterns.
🎯 Exploit Status
Exploitation requires administrative credentials. The vulnerability is in normal administrative interface functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.1
Vendor Advisory: https://www.logstare.com/vulnerability/2025-001/
Restart Required: Yes
Instructions:
1. Download LogStare Collector version 4.2.1 from official vendor site. 2. Backup current configuration. 3. Stop LogStare Collector service. 4. Install/upgrade to version 4.2.1. 5. Restart LogStare Collector service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative accounts to only essential personnel and implement strict access controls.
Implement Strong Password Policies
allEnforce complex passwords and regular rotation to make hash cracking more difficult.
🧯 If You Can't Patch
- Implement multi-factor authentication for all administrative accounts.
- Monitor administrative user activity for unusual hash access patterns.
🔍 How to Verify
Check if Vulnerable:
Check LogStare Collector version. If version is below 4.2.1, the system is vulnerable.Check Version:
logstare-collector --versionVerify Fix Applied:
Verify version is 4.2.1 or higher and test that administrative users cannot access other users' password hashes through the interface.📡 Detection & Monitoring
Log Indicators:
- Unusual administrative user access to user management functions
- Multiple password hash retrieval attempts
Network Indicators:
- Unusual API calls to user credential endpoints from administrative accounts
SIEM Query:
source="logstare" AND (event_type="user_management" OR action="password_hash_access") AND user_role="admin"