CVE-2025-23215: PMD Information Disclosure Vulnerability

CVE-2025-23215 Overview

CVE-2025-23215 affects PMD, an extensible multilanguage static code analyzer. A critical information disclosure vulnerability was discovered where the passphrase for the PMD and PMD Designer release signing keys were inadvertently included in JAR files published to Maven Central. While the private key itself is not known to have been compromised, the exposure of the passphrase means the key must be considered potentially compromised.

This vulnerability represents a significant supply chain security concern, as release signing keys are fundamental to ensuring the authenticity and integrity of software artifacts. An attacker with access to both the passphrase and the private key could potentially sign malicious artifacts that would appear legitimate.

Critical Impact
Exposed signing key passphrase could enable attackers to create fraudulently signed artifacts if the private key were also obtained, potentially compromising the entire software supply chain for PMD users.

Affected Products

PMD (net.sourceforge.pmd group artifacts on Maven Central)
PMD Designer
All versions using the compromised signing keys prior to revocation

Discovery Timeline

2025-01-31 - CVE-2025-23215 published to NVD
2025-04-04 - Last updated in NVD database

Technical Details for CVE-2025-23215

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue stems from sensitive cryptographic material—specifically, the passphrase used to protect the private signing keys—being accidentally bundled within JAR artifacts distributed through Maven Central.

Code signing is a critical security control in the software supply chain. It allows users to verify that software artifacts originated from the expected source and have not been tampered with. When the passphrase protecting a signing key is exposed, it significantly reduces the security barrier for an attacker, as they would only need to obtain the private key file itself to sign malicious code.

The PMD project has taken appropriate remediation action by revoking the compromised signing keys, ensuring they cannot be used for future signatures. Importantly, the project has confirmed that the published artifacts in Maven Central under the net.sourceforge.pmd group ID are not compromised, and existing signatures remain valid.

Root Cause

The root cause of this vulnerability is an operational security failure during the build and packaging process. The signing key passphrase was inadvertently included in the JAR files during the build process, likely due to build configuration files or scripts that contained or referenced the passphrase being packaged into the final artifact.

This type of sensitive information exposure commonly occurs when:

Build scripts or configuration files containing secrets are not properly excluded from artifact packaging
Environment variables or property files with credentials are accidentally bundled
Insufficient review processes for artifact contents prior to publication

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker could exploit this vulnerability through the following approach:

Download PMD or PMD Designer JAR files from Maven Central
Extract and analyze the JAR contents to locate the embedded passphrase
Attempt to obtain the corresponding private key through other means (e.g., source code repositories, leaked backups, or social engineering)
If successful in obtaining both the passphrase and private key, the attacker could sign malicious artifacts that would appear to originate from the legitimate PMD project

The vulnerability exists in artifacts that are publicly available on Maven Central, making the passphrase accessible to anyone who downloads the affected JAR files. Technical details regarding the specific location of the exposed passphrase can be found in the GitHub Security Advisory.

Detection Methods for CVE-2025-23215

Indicators of Compromise

Presence of PMD artifacts signed with the revoked keys after the revocation date
Unexpected or unauthorized PMD artifacts appearing in your Maven repositories
Build failures or signature verification warnings related to PMD dependencies
Modified PMD JAR files with different checksums than those published to Maven Central

Detection Strategies

Verify GPG signature validity for all PMD artifacts and confirm signatures are made with current (non-revoked) keys
Implement artifact verification in your CI/CD pipeline to check Maven Central checksums against downloaded dependencies
Monitor for any artifacts claiming PMD origin that are signed with the revoked keys
Audit your dependency management system for any PMD artifacts from unofficial sources

Monitoring Recommendations

Enable dependency vulnerability scanning in your build pipeline to detect vulnerable PMD versions
Configure alerts for any signature verification failures on PMD-related artifacts
Monitor Maven Central and GitHub releases for official PMD security announcements
Review GPG keyserver revocation lists periodically to ensure compromised keys are flagged

How to Mitigate CVE-2025-23215

Immediate Actions Required

Verify that your PMD installations use artifacts with valid signatures from non-revoked keys
Update your GPG keyring to recognize the revoked status of the compromised PMD signing keys
Review your dependency management configuration to ensure PMD artifacts are sourced only from official Maven Central repositories
Audit your codebase for any local copies of PMD artifacts that may have been downloaded during the vulnerable period

Patch Information

The PMD project has addressed this vulnerability by revoking the compromised signing keys. The fixes are documented in the following commits:

For complete details on the vulnerability and remediation steps, refer to the GitHub Security Advisory GHSA-88m4-h43f-wx84.

Users should ensure they are using the latest versions of PMD and PMD Designer with signatures from the new, non-compromised signing keys.

Workarounds

Configure your build system to verify checksums of PMD artifacts against known-good values from Maven Central
Implement strict dependency pinning for PMD versions with verified signatures
Use artifact repository managers (such as Nexus or Artifactory) with signature verification enabled
Consider using Software Bill of Materials (SBOM) tools to track and verify the provenance of all dependencies

bash

# Verify GPG signature of PMD artifact
gpg --verify pmd-bin-7.x.x.zip.asc pmd-bin-7.x.x.zip

# Check if the signing key has been revoked
gpg --keyserver keyserver.ubuntu.com --refresh-keys

# Maven dependency verification example
mvn dependency:resolve -DverifyArtifacts=true