CVE-2025-54554: tiCrypt Information Disclosure Flaw

CVE-2025-54554 Overview

CVE-2025-54554 is an information disclosure vulnerability in the tiaudit component of Tera Insights tiCrypt before the 2025-07-17 release. The flaw allows unauthenticated attackers to issue REST API requests that expose sensitive details about the underlying SQL queries and database structure. The weakness maps to CWE-863: Incorrect Authorization, indicating that the audit REST endpoints fail to enforce proper access controls before returning query metadata to callers.

Critical Impact
Unauthenticated network attackers can retrieve information about SQL statements and database schema through the tiaudit REST interface, enabling reconnaissance for further attacks against tiCrypt deployments.

Affected Products

Tera Insights tiCrypt (tiaudit component) versions released before 2025-07-17
tiCrypt backend audit REST API
Deployments exposing the tiaudit endpoint to untrusted networks

Discovery Timeline

2025-08-04 - CVE-2025-54554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54554

Vulnerability Analysis

The tiaudit service in tiCrypt exposes REST endpoints designed to surface audit information from the platform's backing database. In vulnerable builds, these endpoints do not verify the requester's identity or authorization before returning response payloads. An unauthenticated caller can query the audit interface and receive data that describes the SQL statements executed by the application and the structure of the underlying database.

While the flaw does not directly enable modification of data or denial of service, it exposes internal implementation details. Attackers can use the disclosed query text and schema information to map table names, column names, and query patterns. This reconnaissance accelerates follow-on attacks such as SQL injection, authorization bypass, or targeted credential theft against tiCrypt-managed data.

Root Cause

The root cause is missing authorization enforcement on the tiaudit REST API [CWE-863]. Endpoints that should be restricted to authenticated administrative roles instead respond to anonymous requests. Debug-oriented or diagnostic fields, including SQL query strings and schema metadata, are serialized directly into the API response.

Attack Vector

Exploitation requires only network reachability to the tiaudit REST endpoint. No credentials, user interaction, or privileges are needed. An attacker sends crafted HTTP requests to the audit routes documented in the TiCrypt Audit Documentation and parses the responses for SQL and schema details.

A proof-of-concept demonstrating the request flow is published in the GitHub PoC Repository. The vulnerability manifests when the audit endpoints are handled without an authorization check, so no exploitation code is required beyond issuing standard HTTP GET requests.

Detection Methods for CVE-2025-54554

Indicators of Compromise

Unauthenticated HTTP requests to tiaudit REST paths originating from external or unexpected IP ranges
Web server or reverse proxy logs showing HTTP 200 responses to audit endpoints without a preceding authentication event
Response bodies from audit endpoints containing raw SQL fragments, table names, or column identifiers
Anomalous spikes in traffic to audit routes documented in the tiCrypt backend audit REST reference

Detection Strategies

Inspect access logs for requests to tiaudit endpoints that lack a valid session cookie or bearer token.
Deploy web application firewall rules that alert on responses containing SQL keywords such as SELECT, FROM, or JOIN from audit routes.
Correlate audit endpoint access with authentication logs to identify unauthenticated queries.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting tiCrypt and forward logs to a centralized analytics platform.
Baseline normal audit endpoint traffic and alert on deviations in request source, volume, or response size.
Monitor egress traffic from tiCrypt servers for unusual data transfer volumes that may indicate scraping of audit data.

How to Mitigate CVE-2025-54554

Immediate Actions Required

Upgrade tiCrypt to the release dated 2025-07-17 or later, which enforces authorization on the tiaudit REST endpoints.
Restrict network access to the tiaudit interface using firewall rules or reverse proxy allow-lists until the patch is applied.
Review historical access logs for unauthenticated requests to audit endpoints and treat any observed access as reconnaissance.

Patch Information

Tera Insights addressed the issue in tiCrypt builds released on or after 2025-07-17. Refer to the TiCrypt Audit Documentation for the current REST interface and to vendor release notes for the specific patched version applicable to your deployment.

Workarounds

Place the tiaudit endpoint behind an authenticating reverse proxy that requires valid credentials before forwarding requests.
Block external access to the audit REST paths at the network perimeter and permit only internal administrative subnets.
Disable the tiaudit REST interface in configuration if audit data is not consumed by external tooling.

bash

# Configuration example: restrict tiaudit REST endpoints at nginx reverse proxy
location /tiaudit/ {
    allow 10.0.0.0/24;      # internal admin subnet
    deny all;
    auth_request /auth;     # require upstream authentication
    proxy_pass http://ticrypt-backend;
}