CVE-2025-54380: Apereo Opencast Credential Disclosure Flaw

CVE-2025-54380 Overview

Apereo Opencast, an open-source platform for managing educational audio and video content, contains a credential disclosure vulnerability in versions prior to 17.6. The flaw allows authenticated users with ingest permissions to force Opencast to transmit its hashed global system account credentials (org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) to attacker-controlled URLs. The issue occurs when Opencast fetches mediapackage elements referenced in a mediapackage XML file. A prior CVE addressed many instances of inappropriate credential transmission, but this attack vector remained. Opencast 17.6 resolves the issue by validating that target nodes are registered in the service registry before sending credentials.

Critical Impact
Any user with ingest permissions can exfiltrate the hashed global system account credentials, enabling potential lateral movement across the Opencast cluster.

Affected Products

Apereo Opencast versions prior to 17.6
Opencast ingest service (IngestServiceImpl)
Opencast security API (DefaultOrganization)

Discovery Timeline

2025-07-26 - CVE-2025-54380 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54380

Vulnerability Analysis

The vulnerability resides in the ingest service of Apereo Opencast. When processing a mediapackage XML file, Opencast fetches referenced mediapackage elements via HTTP. During these fetches, the service attaches the system's digest authentication credentials to outbound requests. The intended behavior is to send credentials only to known cluster nodes. The implementation failed to validate the destination URL against the registered service nodes in all code paths. An attacker with ingest permissions can craft a mediapackage XML that references an external URL under their control. Opencast then transmits the hashed global digest credentials to that URL. The flaw is categorized as information exposure [CWE-200] and insufficiently protected credentials [CWE-522].

Root Cause

The root cause is missing validation of outbound request destinations prior to attaching system credentials. The IngestServiceImpl class used securityService.getOrganization().getServers().keySet() to retrieve cluster URLs but did not consistently enforce the check against the destination URI before adding authentication headers. This gap left a path where arbitrary URLs received authenticated requests.

Attack Vector

Exploitation requires an authenticated account with ingest permissions. The attacker submits a mediapackage XML containing a <track>, <catalog>, or <attachment> element whose URL points to a host they control. When Opencast ingests the mediapackage, it issues an HTTP GET to the attacker's server with the digest authentication header attached. The attacker captures the hashed credentials and can attempt offline cracking or replay attacks against other Opencast cluster components.

java

// Security patch in IngestServiceImpl.java
// Checking that a node is listed in the service registry prior to sending any creds
try {
  if (uri.toString().startsWith("http")) {
    HttpGet get = new HttpGet(uri);
    var clusterUrls = securityService.getOrganization().getServers().keySet();

    if (!isBlank(downloadSource) && uri.toString().matches(downloadSource)) {
      // NB: We're creating a new client here with *different* auth than the system auth creds

Source: Opencast commit e8980435

Detection Methods for CVE-2025-54380

Indicators of Compromise

Outbound HTTP requests from Opencast servers to unknown external hosts carrying Authorization: Digest headers.
Mediapackage XML submissions referencing URLs outside the organization's trusted domains or registered cluster nodes.
Unusual ingest activity from low-privilege accounts referencing external media sources.

Detection Strategies

Review web proxy and firewall logs for outbound requests originating from Opencast nodes to hosts not registered in the Opencast service registry.
Audit ingest service logs for mediapackage XML files containing external URLs in element references.
Correlate authentication attempts against the Opencast digest account from unexpected sources, which may indicate replay of captured credentials.

Monitoring Recommendations

Enable verbose logging on the Opencast ingest service to capture URIs processed during mediapackage ingestion.
Monitor the service registry for unauthorized changes and alert on new cluster node registrations.
Track usage of accounts with ingest permissions and flag anomalous submission patterns.

How to Mitigate CVE-2025-54380

Immediate Actions Required

Upgrade Apereo Opencast to version 17.6 or later, which validates destination URLs against the service registry before attaching credentials.
Rotate the global digest credentials (org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) after patching.
Audit all accounts with ingest permissions and remove unnecessary access.

Patch Information

The fix is implemented in Opencast commit e8980435 and released in Opencast 17.6. Details are available in the GHSA-j63h-hmgw-x4j7 advisory and the related GHSA-hcxx-mp6g-6gr9 advisory. The patch introduces validation ensuring that only URIs matching registered service nodes receive digest authentication headers.

Workarounds

Restrict ingest permissions to trusted administrative users until the upgrade is applied.
Place Opencast behind an egress proxy that blocks outbound HTTP requests to untrusted destinations.
Review and tighten the download.source configuration to constrain which URLs the ingest service will fetch.

bash

# Verify Opencast version after upgrade
curl -s https://opencast.example.org/sysinfo/bundles/version | grep version

# Rotate digest credentials in custom.properties
sed -i 's/^org.opencastproject.security.digest.pass=.*/org.opencastproject.security.digest.pass=NEW_STRONG_SECRET/' \
  /etc/opencast/custom.properties