CVE-2025-15553: Truesec LAPSWebUI Privilege Escalation

CVE-2025-15553 Overview

CVE-2025-15553 is an Insufficient Session Expiration vulnerability (CWE-613) in Truesec's LAPSWebUI before version 2.4. The non-working logout functionality allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords. This vulnerability enables local privilege escalation through session persistence issues in the web interface used to manage Local Administrator Password Solution (LAPS) credentials.

Critical Impact

Attackers with local workstation access can exploit the broken logout functionality to access previously authenticated sessions, potentially disclosing local administrator passwords and enabling privilege escalation across the network.

Affected Products

• Truesec LAPSWebUI versions prior to 2.4

Discovery Timeline

• 2026-03-16 - CVE CVE-2025-15553 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-15553

Vulnerability Analysis

This vulnerability stems from insufficient session expiration controls in Truesec's LAPSWebUI application. When a user attempts to log out of the web interface, the logout functionality fails to properly terminate or invalidate the active session. This means that authenticated sessions remain valid even after a user believes they have logged out, creating a window of opportunity for attackers to hijack these persistent sessions.

The attack requires local access to a workstation where a legitimate user has previously authenticated to LAPSWebUI. Since the application is designed to display and manage local administrator passwords through Microsoft's LAPS solution, successful exploitation can lead to disclosure of sensitive credential information. An attacker gaining access to these credentials could then elevate their privileges on multiple systems throughout the network where those local administrator accounts are valid.

Root Cause

The root cause is CWE-613 (Insufficient Session Expiration). The LAPSWebUI application fails to properly invalidate session tokens when users invoke the logout function. This design flaw allows sessions to persist beyond their intended lifecycle, leaving authentication credentials and session state accessible even after logout attempts. The session management mechanism does not properly clear server-side session data or invalidate client-side tokens upon logout request.

Attack Vector

This is a local attack vector vulnerability requiring physical or remote access to a workstation where a legitimate user has previously authenticated to LAPSWebUI. The attack scenario involves:

1. A legitimate user authenticates to LAPSWebUI to access LAPS-managed credentials
2. The user clicks logout, believing their session has been terminated
3. An attacker with access to the same workstation can reuse the persisted session
4. The attacker gains access to the LAPS interface without re-authentication
5. Local administrator passwords are disclosed to the attacker

The vulnerability requires some user interaction and has attack complexity considerations as the attacker needs to gain workstation access within the session's persistence window. For detailed technical information, see the ReverseC Security Advisory.

Detection Methods for CVE-2025-15553

Indicators of Compromise

• Multiple LAPS credential requests from the same session after logout events have been logged
• Session tokens being reused across different source IP addresses or user contexts
• Unusual access patterns to LAPS-managed credentials outside normal administrative hours

Detection Strategies

• Monitor LAPSWebUI application logs for logout events that are not followed by session termination
• Implement session monitoring to detect reuse of session tokens after logout requests
• Track authentication anomalies where sessions appear to persist beyond expected timeframes
• Correlate LAPS credential access logs with user logout activity to identify post-logout access

Monitoring Recommendations

• Enable detailed logging on the LAPSWebUI application server
• Configure SIEM alerts for session persistence anomalies in LAPS management interfaces
• Monitor for multiple credential lookups following logout events from the same session identifier
• Implement user behavior analytics to detect unusual LAPS credential access patterns

How to Mitigate CVE-2025-15553

Immediate Actions Required

• Upgrade Truesec LAPSWebUI to version 2.4 or later immediately
• Implement session timeout policies that force session expiration after a defined inactivity period
• Ensure users close browser windows and clear browser data after accessing LAPS credentials
• Review LAPS credential access logs for any suspicious post-logout activity

Patch Information

Truesec has addressed this vulnerability in LAPSWebUI version 2.4. Organizations should upgrade to this version or later to remediate the insufficient session expiration issue. Review the ReverseC Security Advisory for additional details.

Workarounds

• Manually clear all browser cookies and session data after using LAPSWebUI until the patch can be applied
• Restrict physical and remote access to workstations used for LAPS administration
• Implement short session timeout values at the web server or reverse proxy level
• Consider using private/incognito browser sessions when accessing LAPSWebUI to ensure session data is cleared on window close
• Use dedicated administrative workstations for LAPS management to limit exposure