CVE-2025-13353: Cloudflare Gokey Info Disclosure Flaw

CVE-2025-13353 Overview

CVE-2025-13353 is a high-severity vulnerability in Cloudflare's gokey password/secret generator affecting versions prior to 0.2.0. A critical flaw in the seed decryption logic causes passwords to be incorrectly derived solely from the initial vector and the AES-GCM authentication tag of the key seed, rather than utilizing the full 240 bytes of entropy from the seed file.

This insecure random number generation vulnerability significantly reduces the entropy of generated keys and secrets, potentially allowing attackers with access to the seed file to recover all derived passwords without knowledge of the master password.

Critical Impact

Keys and secrets generated using seed files may have drastically reduced entropy (28 bytes instead of expected 240 bytes), and malicious actors with seed file access could recover all derived passwords without the master password.

Affected Products

• Cloudflare gokey versions prior to 0.2.0
• gokey installations using the -s seed file option for key/secret generation
• Any systems with credentials derived from gokey seed files

Discovery Timeline

• 2025-12-02 - CVE-2025-13353 published to NVD
• 2025-12-15 - Last updated in NVD database

Technical Details for CVE-2025-13353

Vulnerability Analysis

The vulnerability resides in gokey's seed decryption logic when using the -s option to specify a seed file as entropy input. The flaw results in only 28 bytes of data (the initial vector and AES-GCM authentication tag) being used for password derivation, instead of the full 240-byte seed intended to provide cryptographic entropy.

This cryptographic weakness falls under CWE-330 (Use of Insufficiently Random Values). The CVSS 4.0 score is 7.1 (HIGH) with the following vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. Keys and secrets generated without the -s option (using only the master password) are not affected by this vulnerability.

According to EPSS data from 2025-12-16, this vulnerability has an exploit probability of 0.022% and ranks in the 5.21st percentile.

Root Cause

The root cause is a code logic bug in the seed decryption function. When processing the seed file for key derivation, the implementation incorrectly extracted only the AES-GCM cryptographic parameters (initialization vector and authentication tag) rather than incorporating the full seed data into the key derivation process.

This means the cryptographic material that should provide 240 bytes of entropy was reduced to merely 28 bytes, dramatically weakening the security of all derived keys and secrets.

Attack Vector

The attack vector is local, requiring an attacker to have access to the seed file. The specific attack scenario involves:

An attacker who obtains a copy of the victim's seed file (used with the -s option) can potentially derive all passwords and secrets generated from that seed without ever knowing the master password. This is possible because the vulnerable versions only use readily available metadata from the seed file (IV and authentication tag) rather than the protected seed content.

The vulnerability effectively bypasses the master password protection mechanism for seed-based key derivation, as the actual password-protected entropy was never being utilized in the derivation process.

Detection Methods for CVE-2025-13353

Indicators of Compromise

• Presence of gokey binary versions below 0.2.0 on systems
• Scripts or automation using gokey with the -s seed file option
• Seed files (.gokey or similar) that may have been accessed by unauthorized parties
• Authentication anomalies on systems using gokey-derived credentials

Detection Strategies

Organizations should audit their systems for gokey installations and verify version numbers. The vulnerability specifically impacts deployments using the -s option for seed-based key generation. Security teams should:

1. Inventory all gokey installations across development and production environments
2. Identify credential stores and systems using gokey-derived secrets
3. Review access logs for seed files to identify potential unauthorized access
4. Audit version control systems for gokey binary versions and configuration

Monitoring Recommendations

Monitor for unauthorized access to seed files and track any changes to gokey binaries across the environment. Implement file integrity monitoring on seed files and establish alerts for any access patterns that deviate from normal operational use. Additionally, monitor authentication systems for unusual access patterns that might indicate compromised credentials derived from vulnerable gokey versions.

How to Mitigate CVE-2025-13353

Immediate Actions Required

• Upgrade gokey to version 0.2.0 or later immediately
• Regenerate all passwords and secrets that were created using the -s seed file option
• Rotate credentials on all systems using gokey-derived secrets
• Review access logs for seed files to assess potential compromise

Patch Information

The vulnerability has been fixed in gokey version 0.2.0 and above. This is a breaking change - the fix invalidates any passwords/secrets derived from seed files using the -s option. Even with the same seed file, version 0.2.0 will generate different secrets due to the corrected entropy utilization.

For detailed patch information, refer to the official security advisory at: https://github.com/cloudflare/gokey/security/advisories/GHSA-69jw-4jj8-fcxm

Workarounds

There is no workaround that maintains compatibility with vulnerable versions. Users must upgrade and rotate credentials. The rotation procedure varies by system type:

For systems with "Forgot Password" functionality: Use the password reset mechanism to provision newly generated secrets from gokey 0.2.0.

For systems requiring old password for rotation: Temporarily download gokey version 0.1.3 from the official releases to recover the old password, then use gokey 0.2.0 to generate the new password and complete the rotation.

For systems supporting multiple credentials (e.g., SSH): Generate new credentials with gokey 0.2.0, provision them alongside existing credentials, verify access works, then revoke the old credentials.

# Upgrade gokey to patched version
go install github.com/cloudflare/gokey@v0.2.0

# Verify installed version
gokey -version

# Generate new secrets with patched version (existing seed file)
gokey -p "master_password" -s /path/to/seed.file -r "service_realm" -o new_secret.txt