CVE-2025-49009: Para Framework Token Exposure Vulnerability

CVE-2025-49009 Overview

CVE-2025-49009 affects Para, a multitenant backend server and framework for object persistence and retrieval. The vulnerability exists in FacebookAuthFilter.java in versions prior to 1.50.8. When a request to a Facebook user profile fails, the filter logs the full request URL at WARN level. The URL contains the user's Facebook OAuth access token in plain text.

Since WARN-level entries are commonly retained in production and forwarded to log aggregation systems, tokens become accessible to operators, administrators, and downstream log processors. The issue is tracked as [CWE-532: Insertion of Sensitive Information into Log File]. Version 1.50.8 resolves the exposure.

Critical Impact
Facebook OAuth access tokens are written to application logs and can be harvested by anyone with access to production log stores, enabling account takeover against affected users.

Affected Products

Para (Erudika) versions prior to 1.50.8
Applications embedding the Para server framework with Facebook authentication enabled
Downstream log aggregation systems retaining Para WARN-level output

Discovery Timeline

2025-06-05 - CVE-2025-49009 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49009

Vulnerability Analysis

Para's FacebookAuthFilter handles OAuth authentication against Facebook's Graph API. During the callback flow, the filter exchanges an authorization code for an access token, then queries the /me profile endpoint with the token appended as a query parameter. When that HTTP request fails, error-handling code logs the full outbound URL to help operators diagnose the failure.

The logged URL contains the access_token query parameter unmasked. Any actor with read access to the log file, container stdout, or centralized log platform can extract valid Facebook tokens. Tokens can then be replayed against Facebook APIs to read profile data, list friends, or perform actions authorized by the granted scopes, subject to Facebook's token lifetime.

The root cause is a logging hygiene defect rather than a network-exposed flaw, which is reflected in the local attack vector scoring. The impact remains high on confidentiality because the leaked material is a bearer credential.

Root Cause

The filter constructs a full request URL that embeds the OAuth bearer token and passes that URL to the logger without redaction. CWE-532 classifies this pattern as sensitive information insertion into a log file. There was no filter or masking on token-bearing query parameters before emitting the WARN message.

Attack Vector

Exploitation requires access to Para's application logs. This typically means a local operator account, an SRE with log-viewer permissions, a compromised log-forwarding agent, or an attacker who has already gained a foothold in log aggregation infrastructure such as Elasticsearch, Splunk, or a cloud logging service. No network interaction with Para itself is required once logs are accessible.

java

// Patched imports in FacebookAuthFilter.java (v1.50.8)
 import com.erudika.para.server.security.UserAuthentication;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectReader;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.config.RequestConfig;
// Source: https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf
// The full commit removes the URL from the WARN-level log statement so
// access tokens are no longer written to log output.

Detection Methods for CVE-2025-49009

Indicators of Compromise

WARN-level log entries from FacebookAuthFilter containing a graph.facebook.com URL with an access_token= query parameter.
Log lines showing failed Facebook profile lookups that include OAuth token material in plain text.
Unexpected outbound Facebook Graph API calls from IP addresses associated with log-viewer accounts or SRE workstations.

Detection Strategies

Grep production and archived logs for the pattern access_token= alongside FacebookAuthFilter or graph.facebook.com.
Add a log-analytics rule that alerts when OAuth bearer tokens or query parameters named access_token, code, or client_secret appear in any log stream.
Review SIEM and log aggregation platforms for retained historical entries containing exposed tokens and treat matches as credential exposures.

Monitoring Recommendations

Instrument Facebook Graph API traffic and alert on token use from unexpected source IPs or user agents.
Track access to log storage and forward audit events for anyone reading Para application logs.
Monitor for new Para releases and correlate deployed versions against the fixed release 1.50.8.

How to Mitigate CVE-2025-49009

Immediate Actions Required

Upgrade all Para deployments to version 1.50.8 or later.
Purge or redact historical log entries containing Facebook access tokens from disk, backups, and centralized log stores.
Rotate or invalidate any Facebook OAuth tokens that may appear in retained logs and force affected users to re-authenticate.

Patch Information

The fix is delivered in Para 1.50.8. Details are available in the GitHub Security Advisory GHSA-qx7g-fx8q-545g and the upstream commit, which removes the token-bearing URL from the WARN log statement.

Workarounds

Raise the FacebookAuthFilter logger threshold above WARN to suppress the offending message until patching is possible.
Insert a log-pipeline filter that masks access_token= query parameters before events reach persistent storage.
Restrict access to log storage and forwarders to the minimum set of operators required for incident response.

bash

# Example logback configuration snippet to suppress the vulnerable logger
# until the upgrade to Para 1.50.8 is completed.
<logger name="com.erudika.para.server.security.filters.FacebookAuthFilter" level="ERROR"/>