CVE-2025-57813: traQ Messenger Information Disclosure Flaw

CVE-2025-57813 Overview

traQ is a messenger application developed by the Digital Creators Club traP. Versions prior to 3.25.0 write sensitive information, including OAuth tokens, into log files when SQL query execution errors occur. An attacker can deliberately induce SQL errors by placing high load on the database backend. Any actor with read access to the log files can then harvest the recorded tokens and other sensitive data. The maintainers patched the issue in version 3.25.0 by adjusting the GORM logger verbosity. The weakness is classified under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact

Attackers who can trigger SQL errors and access log files can extract OAuth tokens, enabling account impersonation and unauthorized API access.

Affected Products

• traQ messenger application prior to version 3.25.0
• Deployments using the GORM ORM with default logger verbosity
• Self-hosted instances operated by the Digital Creators Club traP and downstream users

Discovery Timeline

• 2025-08-26 - CVE-2025-57813 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57813

Vulnerability Analysis

The vulnerability stems from verbose logging behavior in the GORM ORM library used by traQ. When an SQL query fails, GORM logs the full statement, including parameter values bound to the query. traQ stores OAuth tokens and other credentials in database tables, so failed queries touching these tables emit sensitive values into the application log stream.

An attacker with the ability to stress the database, for example by sending high request volumes or triggering timeout conditions, can force query errors. The resulting log entries capture the parameterized values from the affected SQL statements. Any user or process authorized to read the log files can then extract OAuth tokens and use them to impersonate legitimate accounts against the traQ API.

The attack requires high privileges to reach the log store and high attack complexity because the adversary must reliably induce database errors. However, the confidentiality and integrity impact is significant once tokens are recovered.

Root Cause

The default GORM logger level emits SQL statements and their bound parameters on error. traQ did not override this behavior, allowing sensitive column values to be serialized into logs whenever the database returned an error.

Attack Vector

The attacker first induces SQL errors by generating heavy database load, forcing query timeouts, or submitting inputs that produce constraint violations. The attacker then reads the resulting error log entries, which contain the failing statement and its parameter values, including OAuth tokens stored in queried rows.

// Patch: cmd/serve.go — import GORM logger to configure silent level
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
 	"golang.org/x/sync/errgroup"
+	gormlogger "gorm.io/gorm/logger"
 
 	"github.com/traPtitech/traQ/event"
 	"github.com/traPtitech/traQ/repository"

Source: traQ commit ce5da94. The change imports the GORM logger package so the maintainers can set the log level to Silent, suppressing sensitive statement output during SQL errors.

Detection Methods for CVE-2025-57813

Indicators of Compromise

• Log entries containing raw SQL statements with OAuth token strings, session identifiers, or bearer credentials in bound parameter values
• Bursts of database timeout or constraint violation errors preceding suspicious API activity
• API requests using OAuth tokens from source IP addresses that do not match the token owner's historical activity

Detection Strategies

• Grep or query log stores for the pattern of GORM-formatted SQL error entries that include token-shaped strings in parameter positions
• Correlate spikes in database error rates with subsequent read access to log files or log shipping systems
• Baseline OAuth token usage per client and alert on tokens appearing from new user agents or geographies shortly after log-access events

Monitoring Recommendations

• Forward traQ application logs to a centralized SIEM and apply parsing rules for GORM error signatures
• Track file access audit events on the log directory and alert on reads by non-administrative accounts
• Monitor the traQ OAuth token issuance and refresh endpoints for anomalous revocation or refresh patterns

How to Mitigate CVE-2025-57813

Immediate Actions Required

• Upgrade traQ to version 3.25.0 or later, which sets the GORM logger to a level that does not emit parameter values on error
• Rotate all OAuth tokens, client secrets, and other credentials that may have been written to historical log files
• Restrict read permissions on existing log files and archives, then purge or sanitize logs that contain sensitive parameter values

Patch Information

The fix ships in traQ 3.25.0 via Pull Request #2787 and commit ce5da94. See the GitHub Security Advisory GHSA-27r7-3m9x-r533 for the full disclosure.

Workarounds

• Review and tighten filesystem permissions on the traQ log directory so only the service account and named administrators can read entries
• Restrict access to log aggregation platforms and audit any existing exports containing SQL error output
• Add filters in the log pipeline to redact strings matching OAuth token formats before storage or forwarding

# Restrict access to traQ log files as a temporary workaround
sudo chown traq:traq /var/log/traq/*.log
sudo chmod 600 /var/log/traq/*.log
sudo find /var/log/traq -type f -name '*.log' -exec chmod 600 {} \;