CVE-2025-47222 Overview
CVE-2025-47222 is an information disclosure vulnerability in Keyfactor SignServer versions prior to 7.3.2. The flaw allows unauthenticated network attackers to enumerate class names loaded in the application. When any chosen class name is set to properties requiring a class path, the application returns distinguishable errors based on whether the class exists in the deployment. This behavior exposes information about internal application classes to client-side callers. The issue is tracked under CWE-284 (Improper Access Control) and affects the signserver component from Keyfactor.
Critical Impact
Unauthenticated attackers can enumerate loaded classes in SignServer deployments, enabling reconnaissance for follow-on attacks against the signing infrastructure.
Affected Products
- Keyfactor SignServer versions prior to 7.3.2
- Keyfactor SignServer Community Edition (pre-7.3.2 builds)
- Keyfactor SignServer Enterprise Edition (pre-7.3.2 builds)
Discovery Timeline
- 2025-11-13 - CVE-2025-47222 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47222
Vulnerability Analysis
The vulnerability resides in SignServer's handling of configuration properties that accept fully qualified Java class names. When an administrator or API caller sets a class-path property, the server attempts to resolve and load the specified class. The response distinguishes between classes that exist in the deployment and those that do not. An attacker leveraging this behavior can iteratively submit candidate class names and infer the internal composition of the running application. This class enumeration provides reconnaissance value for chaining with deserialization, reflection, or dependency-specific exploits.
Root Cause
The root cause is improper access control combined with verbose error differentiation. SignServer returns different error signals when a supplied class exists versus when it does not, exposing loaded-class state to the client. The application does not normalize error responses or restrict class-lookup feedback to authenticated administrative contexts.
Attack Vector
The attack is executed over the network against SignServer's management or configuration interface. The attacker submits crafted property values containing candidate class names and observes response differences. No user interaction is required, and the technique produces confirmed enumeration of internal classes and libraries. The disclosed information can support targeted exploitation of vulnerable libraries within the deployment.
The vulnerability manifests in class-resolution logic used by property setters. See the Keyfactor SignServer CVE-2025-47222 Article for vendor technical details.
Detection Methods for CVE-2025-47222
Indicators of Compromise
- Repeated configuration or property-set API calls submitting varying fully qualified Java class names against SignServer endpoints.
- Bursts of error responses tied to class-path properties from a single client or IP address.
- Unauthenticated or low-privilege sessions probing administrative or worker configuration surfaces.
Detection Strategies
- Monitor SignServer application logs for high volumes of class-resolution errors originating from the same source.
- Alert on sequential property-set operations that submit dictionary-style class name candidates such as org.apache.*, com.sun.*, or java.* prefixes.
- Correlate authentication logs with property configuration activity to identify probing without administrative context.
Monitoring Recommendations
- Enable verbose audit logging on SignServer worker and global configuration APIs.
- Forward SignServer logs to a centralized SIEM for pattern analysis and long-term retention.
- Baseline normal configuration-change frequency and alert on statistical anomalies.
How to Mitigate CVE-2025-47222
Immediate Actions Required
- Upgrade Keyfactor SignServer to version 7.3.2 or later on all deployments.
- Restrict network access to SignServer management interfaces to trusted administrative networks only.
- Review recent configuration-change and property-set logs for signs of class enumeration activity.
- Rotate credentials and API tokens used against SignServer if unauthorized probing is confirmed.
Patch Information
Keyfactor released the fix in SignServer 7.3.2. Refer to the Keyfactor SignServer Release Notes for upgrade guidance, and the Keyfactor Support Portal for enterprise assistance. The patched release normalizes error responses so that class-existence state is no longer distinguishable to callers.
Workarounds
- Place SignServer behind a reverse proxy or WAF that restricts property-set endpoints to authenticated administrative sessions.
- Enforce network segmentation so that only jump hosts or bastion systems can reach the SignServer administration interface.
- Rate-limit configuration API requests to slow enumeration attempts until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
