CVE-2025-15617: Wazuh Information Disclosure Vulnerability

CVE-2025-15617 Overview

CVE-2025-15617 is an information disclosure vulnerability affecting Wazuh version 4.12.0 that involves the exposure of the GITHUB_TOKEN through GitHub Actions workflow artifacts. This vulnerability, classified under CWE-522 (Insufficiently Protected Credentials), allows attackers to extract the authentication token from uploaded workflow artifacts and potentially leverage it to perform unauthorized repository actions within a limited time window.

Critical Impact

Attackers can extract the GITHUB_TOKEN from workflow artifacts and use it to push malicious commits, alter release tags, or perform other unauthorized actions against the Wazuh repository before the token expires.

Affected Products

• Wazuh version 4.12.0
• Wazuh GitHub Actions workflows with artifact uploads containing tokens

Discovery Timeline

• 2026-03-27 - CVE-2025-15617 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2025-15617

Vulnerability Analysis

This vulnerability stems from insecure handling of GitHub Actions workflow artifacts in Wazuh 4.12.0. When GitHub Actions workflows execute, they automatically receive a GITHUB_TOKEN with permissions scoped to the repository. The vulnerability occurs when workflow artifacts inadvertently include this token or files containing it, making the sensitive credential accessible to anyone who can download the artifacts.

GitHub Actions workflow artifacts are publicly accessible for public repositories, and even for private repositories, anyone with read access can download them. The GITHUB_TOKEN has a default validity period (typically until the workflow job completes), but in certain configurations, this window may be long enough for an attacker to perform malicious actions.

Root Cause

The root cause of this vulnerability is the insufficient protection of credentials within the CI/CD pipeline. Specifically, the Wazuh workflow configuration allowed sensitive token information to be captured in workflow artifacts. This represents a failure to properly sanitize or exclude sensitive environment variables and authentication tokens from artifact uploads.

Workflow configurations that use broad artifact upload patterns (such as **/* or uploading entire directories) without explicitly excluding sensitive files or environment variable dumps can inadvertently expose tokens.

Attack Vector

The attack vector for CVE-2025-15617 is network-based, requiring the attacker to:

1. Monitor or access the target repository's GitHub Actions workflow runs
2. Download workflow artifacts from completed or in-progress runs
3. Extract the GITHUB_TOKEN from the artifact contents
4. Use the token within its validity window to perform unauthorized actions

Potential malicious actions include pushing commits containing backdoors, modifying release tags to point to malicious code, creating or modifying branches, and manipulating pull requests. The attack requires high complexity as the attacker must act within the token's limited validity period.

The exploitation process involves analyzing artifact contents for token patterns, often found in environment variable dumps, log files, or cached credential files that may be inadvertently included in artifact uploads.

Detection Methods for CVE-2025-15617

Indicators of Compromise

• Unexpected commits or tag modifications in the repository from automated workflows
• Suspicious API activity using GITHUB_TOKEN authentication outside normal workflow execution times
• Artifact downloads from unknown IP addresses or unusual geographic locations
• Repository modifications that don't correspond to legitimate pull request merges

Detection Strategies

• Monitor GitHub audit logs for API calls authenticated with workflow tokens occurring outside expected workflow execution windows
• Implement alerts for artifact downloads from public workflows, especially from IP addresses not associated with legitimate CI/CD infrastructure
• Review workflow configurations for patterns that may inadvertently include sensitive files in artifacts
• Audit repository activity logs for unauthorized commits, tag changes, or branch modifications

Monitoring Recommendations

• Enable GitHub's security logging and forward audit events to your SIEM for correlation analysis
• Configure alerts for any repository write operations (commits, tag modifications, branch creations) that originate from automated workflows outside expected windows
• Periodically audit all workflow artifact contents for sensitive data exposure
• Implement repository branch protection rules requiring signed commits and pull request reviews

How to Mitigate CVE-2025-15617

Immediate Actions Required

• Review all GitHub Actions workflows in affected Wazuh 4.12.0 deployments for artifact upload configurations
• Audit existing workflow artifacts for token exposure and delete any artifacts containing sensitive credentials
• Update workflow configurations to explicitly exclude sensitive files and environment variable dumps from artifact uploads
• Implement stricter artifact upload patterns that only include necessary files

Patch Information

Refer to the Wazuh GitHub Security Advisory (GHSA-6xqr-4q5g-xc7x) for official remediation guidance and updated workflow configurations. Additional technical details are available in the VulnCheck Advisory on GitHub Token Exposure.

Workarounds

• Configure artifact uploads to use explicit file paths rather than wildcard patterns to prevent accidental inclusion of sensitive files
• Add .gitignore-style exclusion patterns to artifact upload steps to filter out files containing tokens or credentials
• Reduce GITHUB_TOKEN permissions using the permissions key in workflow files to minimize potential impact if exposed
• Consider using short-lived, scoped tokens with minimal necessary permissions for CI/CD operations

# Example workflow configuration with reduced token permissions
permissions:
  contents: read
  packages: read
  # Explicitly deny write permissions unless required
  
# Example artifact upload with explicit paths (avoid wildcards)
- uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: |
      dist/
      !dist/**/*.log
      !**/.env