CVE-2025-32016: Microsoft Identity Web Info Disclosure

CVE-2025-32016 Overview

CVE-2025-32016 is an Information Disclosure vulnerability affecting Microsoft Identity Web, a library containing reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform (formerly Azure AD v2.0 endpoint) and Azure AD B2C. This vulnerability impacts confidential client applications, including daemons, web apps, and web APIs.

Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely, but this vulnerability causes credential descriptions containing local file paths with passwords, Base64 encoded values, or client secrets to be logged at the information level. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level.

Critical Impact

Sensitive authentication credentials including client secrets and certificate details may be exposed in application service logs, potentially allowing attackers with log access to harvest authentication material.

Affected Products

• Microsoft.Identity.Web (versions prior to 3.8.2)
• Microsoft.Identity.Abstractions (versions prior to 9.0.0)
• ASP.NET Core applications using Microsoft Identity Web for Azure AD/B2C integration

Discovery Timeline

• 2025-04-09 - CVE-2025-32016 published to NVD
• 2025-04-09 - Last updated in NVD database

Technical Details for CVE-2025-32016

Vulnerability Analysis

This vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). The issue occurs when confidential client applications integrated with Microsoft Identity Web inadvertently log sensitive authentication material to service logs.

The exposure affects multiple credential types and logging scenarios. When services generate logs at the information level, credential descriptions containing local file paths with embedded passwords, Base64 encoded secret values, or plain client secrets may be written to log output. Furthermore, applications utilizing Base64 encoded certificates or certificate paths that include password credential descriptions are vulnerable if those certificates are invalid or expired—this logging occurs regardless of the configured log level.

While Microsoft notes that expired or invalid certificates are not directly usable, the exposure of credential patterns, file paths, and Base64 encoded values in logs presents a significant risk if those logs are accessed by unauthorized parties or stored insecurely. Attackers with access to log files could potentially extract sensitive authentication material or use the disclosed information to understand the authentication architecture of the target application.

Root Cause

The root cause stems from insufficient sanitization of credential information before logging operations. The Microsoft Identity Web library fails to properly redact or mask sensitive credential details when constructing log messages, particularly for:

1. Credential descriptions that include file system paths containing embedded passwords
2. Base64 encoded certificate or secret values
3. Client secret values in certain logging contexts
4. Certificate credential descriptions when certificate validation fails

Attack Vector

This is a local attack vector vulnerability requiring the attacker to have access to the service logs generated by affected applications. The attack scenario involves:

1. An attacker gains access to application log files through misconfigured log storage, compromised log aggregation services, or insider access
2. The attacker searches log entries for credential patterns, Base64 encoded values, or file paths containing authentication information
3. Extracted credential material may be used to authenticate as the compromised service or to understand the application's authentication infrastructure

The vulnerability does not require user interaction and can be exploited by attackers with low privileges who have read access to the affected log files. While the attack complexity is high due to the specific conditions required for credential exposure, successful exploitation results in high confidentiality impact.

Detection Methods for CVE-2025-32016

Indicators of Compromise

• Unexpected access to application log files or log storage locations
• Log queries searching for Base64 encoded patterns or credential-related keywords
• Unauthorized authentication attempts using service principal credentials
• Evidence of log file exfiltration from application servers or log aggregation systems

Detection Strategies

• Audit and monitor access to application log files and log storage systems
• Implement alerting for bulk log file downloads or unusual log query patterns
• Review authentication logs for service principals to detect unauthorized usage of potentially exposed credentials
• Scan existing log files for exposed credential patterns to assess potential impact

Monitoring Recommendations

• Enable monitoring on log storage locations (file systems, Azure Log Analytics, SIEM systems) for unusual access patterns
• Implement file integrity monitoring on log directories to detect unauthorized access
• Configure alerts for failed authentication attempts using service principal identities
• Monitor for reconnaissance activities targeting logging infrastructure or log aggregation endpoints

How to Mitigate CVE-2025-32016

Immediate Actions Required

• Update Microsoft.Identity.Web to version 3.8.2 or later immediately
• Update Microsoft.Identity.Abstractions to version 9.0.0 or later
• Review and rotate any credentials that may have been exposed in historical log files
• Audit log files for exposed credential material and securely purge affected entries
• Restrict access to application logs following principle of least privilege

Patch Information

Microsoft has released patches to address this vulnerability. Update to the following versions to mitigate the issue:

• Microsoft.Identity.Web: Version 3.8.2 or later
• Microsoft.Identity.Abstractions: Version 9.0.0 or later

These updates can be obtained through NuGet package management. For additional details, refer to the GitHub Security Advisory GHSA-rpq8-q44m-2rpg.

Workarounds

• Reduce logging verbosity to minimize information-level log generation until patches can be applied
• Implement log filtering to redact or mask potentially sensitive credential patterns before log storage
• Ensure log files are stored with appropriate access controls and encryption
• Consider using managed identities instead of client secrets where possible to reduce credential exposure risk

# Update Microsoft.Identity.Web via .NET CLI
dotnet add package Microsoft.Identity.Web --version 3.8.2

# Update Microsoft.Identity.Abstractions via .NET CLI
dotnet add package Microsoft.Identity.Abstractions --version 9.0.0

# Verify installed package versions
dotnet list package | grep -i "Microsoft.Identity"