CVE-2025-49618: Plesk Obsidian Information Disclosure Flaw

CVE-2025-49618 Overview

CVE-2025-49618 is an information disclosure vulnerability in Plesk Obsidian 18.0.69. Unauthenticated HTTP requests to the /login_up.php endpoint return sensitive AWS configuration data. The response exposes an AWS accessKeyId, secretAccessKey, region, and endpoint. The flaw is categorized under CWE-402: Transmission of Private Resources into a New Sphere. Any remote attacker who can reach the Plesk login interface can retrieve these credentials without authentication. Recovered keys can then be used against the associated AWS environment to access storage, compute, or backup resources tied to the Plesk instance.

Critical Impact
Unauthenticated network attackers can extract live AWS access keys from the Plesk login page and pivot into cloud infrastructure.

Affected Products

Plesk Obsidian 18.0.69
Plesk-managed hosting servers exposing /login_up.php to the internet
AWS accounts whose credentials are referenced by the affected Plesk instance

Discovery Timeline

2025-07-03 - CVE-2025-49618 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49618

Vulnerability Analysis

The vulnerability resides in the Plesk Obsidian login workflow. The /login_up.php endpoint processes requests before any authentication check occurs. In version 18.0.69, the response body leaks AWS credentials embedded in the server configuration. An attacker only needs network reachability to the Plesk web interface. No user interaction, session, or account is required. The disclosed credentials include a full IAM key pair along with the region and endpoint values needed to target the correct AWS service. This provides an attacker with an immediate lateral movement path from a public-facing hosting panel into the cloud tenancy that supports it. The EPSS probability is 0.349% at the 26.93 percentile, indicating limited observed exploitation attempts to date.

Root Cause

The root cause is improper transmission of private resources into a public response sphere [CWE-402]. Configuration data intended for internal use by Plesk backup or storage integrations is serialized into the response of an unauthenticated endpoint. There is no authorization gate protecting the fields containing the AWS credentials.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues an HTTP request to https://<plesk-host>/login_up.php and parses the response for AWS credential fields. See the LinkedIn post by Gaetano Cesano for the original disclosure narrative. No verified public exploit code is available; the vulnerability is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2025-49618

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to /login_up.php from unfamiliar source addresses.
Outbound AWS API calls from hosts that historically only communicated with Plesk-managed services.
CloudTrail events showing the Plesk-associated IAM key used from IP ranges outside the hosting environment.

Detection Strategies

Inspect web server access logs for repeated requests to /login_up.php without a preceding authentication flow.
Correlate Plesk request logs with AWS CloudTrail GetCallerIdentity, ListBuckets, and AssumeRole activity for the same IAM principal.
Alert on any HTTP response from /login_up.php that contains the strings accessKeyId or secretAccessKey.

Monitoring Recommendations

Enable CloudTrail data events for S3 buckets referenced by Plesk backup configuration.
Deploy AWS GuardDuty and monitor for UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration findings tied to Plesk keys.
Rate-limit and log all traffic to Plesk authentication endpoints at the reverse proxy or WAF layer.

How to Mitigate CVE-2025-49618

Immediate Actions Required

Upgrade Plesk Obsidian to the fixed release referenced in the Plesk 18.0.69 announcement and subsequent hotfixes.
Rotate every AWS access key referenced in the Plesk backup or storage configuration.
Review CloudTrail history for the exposed IAM principal and revoke any suspicious sessions.
Restrict access to the Plesk web interface to trusted management IP ranges.

Patch Information

Administrators should apply the vendor update tracked in the Plesk Obsidian 18.0.69 release channel and any later micro-updates that address /login_up.php credential exposure. Confirm the patch level in the Plesk UI under Tools & Settings > Updates. Reference the Plesk Blog Announcement for release notes.

Workarounds

Block external access to /login_up.php at the reverse proxy or WAF until the patch is applied.
Replace long-lived AWS access keys with short-lived IAM Role credentials scoped to specific S3 backup prefixes.
Apply least-privilege IAM policies so that a leaked key cannot enumerate or delete unrelated resources.

bash

# Nginx snippet to block unauthenticated access to the vulnerable endpoint
location = /login_up.php {
    allow 203.0.113.0/24;   # trusted admin range
    deny all;
    return 403;
}