CVE-2025-8525
📋 TL;DR
This vulnerability in Exrick xboot allows remote attackers to access sensitive information through Spring Boot Admin/Spring Actuator endpoints. It affects all systems running Exrick xboot versions up to 3.3.4. The information disclosure could expose configuration details, environment variables, or other sensitive data.
💻 Affected Systems
- Exrick xboot
📦 What is this software?
Xboot by Exrick
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive credentials, API keys, or configuration secrets leading to further system compromise.
Likely Case
Exposure of internal system information, configuration details, or environment variables that could aid attackers in reconnaissance.
If Mitigated
Limited exposure of non-critical information with proper access controls and network segmentation.
🎯 Exploit Status
Exploit details are publicly available; remote unauthenticated access to information endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.5 or later
Vendor Advisory: https://github.com/Exrick/xboot/issues/72
Restart Required: Yes
Instructions:
1. Check current version. 2. Update to xboot 3.3.5+. 3. Restart the application. 4. Verify endpoints are secured.
🔧 Temporary Workarounds
Disable or Secure Actuator Endpoints
allRestrict access to Spring Boot Actuator endpoints via authentication or network controls.
management.endpoints.web.exposure.include=health,info
management.endpoint.health.show-details=never
Network Segmentation
allRestrict network access to actuator endpoints using firewalls or security groups.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure.
- Add authentication/authorization to all actuator endpoints.
🔍 How to Verify
Check if Vulnerable:
Check if xboot version is ≤3.3.4 and actuator endpoints are accessible without authentication.Check Version:
Check application.properties or build.gradle for xboot version.Verify Fix Applied:
Verify version is ≥3.3.5 and actuator endpoints require authentication or return 403/404.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /actuator/* endpoints
- Multiple 200 responses from actuator paths
Network Indicators:
- Unusual traffic to actuator endpoints from external IPs
SIEM Query:
source_ip=external AND uri_path CONTAINS '/actuator/' AND response_code=200