CVE-2025-24355: Updatecli Information Disclosure Flaw

CVE-2025-24355 Overview

CVE-2025-24355 is an information disclosure vulnerability in Updatecli, a tool used to apply file update strategies across repositories and configuration files. Versions prior to 0.93.0 leak private Maven repository credentials in application logs when a retrieval operation fails. The pipeline correctly sanitizes basic authentication credentials during successful operations, but the sanitization is bypassed on failure conditions such as invalid coordinates, missing artifacts, or unknown versions. Any actor with read access to pipeline logs, including CI/CD job artifacts, can extract the plaintext credentials embedded in Maven URLs. The vulnerability is tracked under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Maven repository basic authentication credentials are written in plaintext to Updatecli logs on failed retrievals, exposing them to anyone with access to CI/CD build output.

Affected Products

Updatecli versions prior to 0.93.0
Updatecli pipelines using the maven source with basic authentication
CI/CD environments executing vulnerable Updatecli pipelines against private Maven repositories

Discovery Timeline

2025-01-24 - CVE-2025-24355 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24355

Vulnerability Analysis

Updatecli constructs Maven repository URLs that embed basic authentication credentials directly in the URL userinfo component, following the https://user:password@host/path pattern. During normal pipeline execution, the tool applies a redaction routine before writing URLs to log output. The redaction path is only invoked on the success branch of the retrieval logic. When the Maven repository returns an error, the raw URL string flows into logrus.Debugf and similar log calls without sanitization. Common failure triggers include wrong artifact coordinates, non-existent versions, HTTP 404 responses, and network errors. The leaked credentials retain full access to the private Maven repository, allowing attackers to read internal artifacts or publish malicious packages if write permissions are present.

Root Cause

The root cause is inconsistent application of the redact.URL helper across code paths in pkg/core/text/main.go and pkg/plugins/resources/maven/condition.go. Error and debug log statements referenced the original location variable rather than its redacted form. Successful branches were retrofitted with redaction earlier, but failure branches were missed during that refactor.

Attack Vector

Exploitation requires access to Updatecli execution logs. In practice, this means access to CI/CD job output, log aggregation systems, or debug artifacts produced during pipeline runs. An attacker who can trigger a failed Maven lookup, for example by submitting a pull request that references an invalid artifact version, can cause the target pipeline to emit credentials to logs it can later read.

// Source: https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa
// pkg/core/text/main.go - patch applies redact.URL before logging
// "https://", or file url "file://" or filepath (default)
func (t *Text) ReadAll(location string) (string, error) {
	if IsURL(location) {
-		logrus.Debugf("URL detected for location %q", location)
+		logrus.Debugf("URL detected for location %q", redact.URL(location))
		content, err := t.readFromURL(location, 0)
		if err != nil {
			return "", err

The patch imports the redact utility into the Maven condition resource so that the same sanitization applies to failure paths:

// Source: https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa
// pkg/plugins/resources/maven/condition.go
	"github.com/sirupsen/logrus"

	"github.com/updatecli/updatecli/pkg/core/pipeline/scm"
+	"github.com/updatecli/updatecli/pkg/plugins/utils/redact"
)

// Condition tests if a specific version exist on the maven repository

Detection Methods for CVE-2025-24355

Indicators of Compromise

Log lines containing Maven repository URLs with embedded user:password@ userinfo segments
Updatecli debug messages emitted immediately after a failed Maven retrieval or condition check
CI/CD build artifacts or archived pipeline logs referencing private Maven hosts alongside plaintext basic auth strings
Unexpected authentication activity against private Maven repositories originating from CI runner IP ranges

Detection Strategies

Scan historical CI/CD logs for the regex pattern https?://[^:/@\s]+:[^@\s]+@ scoped to Updatecli job output
Correlate Updatecli pipeline failures with Maven repository error responses to identify runs likely to have leaked credentials
Audit log retention systems and third-party log shippers for retained pipeline output that predates the upgrade to 0.93.0

Monitoring Recommendations

Enable secret scanning on CI/CD log stores and job artifact buckets
Alert on authentication events to private Maven repositories from sources outside expected CI ranges
Track Updatecli version usage across pipelines and flag any execution of versions below 0.93.0

How to Mitigate CVE-2025-24355

Immediate Actions Required

Upgrade Updatecli to version 0.93.0 or later across all pipelines and runners
Rotate every Maven repository credential that was configured in an Updatecli pipeline prior to the upgrade
Purge or restrict access to historical CI/CD logs that may contain leaked credentials
Review Maven repository access logs for any unauthorized artifact reads or publishes

Patch Information

The fix is contained in Updatecli commit 344b280 and released in version 0.93.0. Details are documented in the GitHub Security Advisory GHSA-v34r-vj4r-38j6. The patch applies the redact.URL helper to log statements in pkg/core/text/main.go and imports the redact package into pkg/plugins/resources/maven/condition.go so failure-path logs are sanitized.

Workarounds

Store Maven credentials in a secrets manager and inject them at runtime with tightly scoped read-only permissions
Disable debug logging for Updatecli pipelines that target authenticated Maven repositories until the upgrade is applied
Restrict visibility of CI/CD job logs to trusted maintainers and disable log forwarding to shared systems

bash

# Configuration example: upgrade Updatecli and verify the fixed version
curl -sSL https://github.com/updatecli/updatecli/releases/download/v0.93.0/updatecli_Linux_x86_64.tar.gz \
  | tar -xz -C /usr/local/bin updatecli
updatecli version | grep -E '0\.9[3-9]\.|0\.[1-9][0-9]{2,}\.'