CVE-2025-62514: Parsec Information Disclosure Vulnerability

CVE-2025-62514 Overview

CVE-2025-62514 is a cryptographic vulnerability affecting Parsec, a cloud-based application designed for cryptographically secure file sharing. The vulnerability exists in libparsec_crypto, a core cryptographic component of the Parsec application, which fails to validate weak order points of Curve25519 when compiled with its RustCrypto backend. This oversight enables a man-in-the-middle (MITM) attacker to inject weak order points during the Diffie-Hellman key exchange process, potentially compromising the confidentiality and integrity of encrypted communications.

Critical Impact

An attacker positioned between two communicating parties can manipulate the Diffie-Hellman exchange by providing weak order points, resulting in a high probability that both parties derive the same shared key—a key that is also known to the attacker. This effectively defeats the Short Authentication String (SAS) code exchange mechanism, misleading both parties into believing no MITM attack has occurred while the attacker can decrypt all communications.

Affected Products

• Parsec Web (versions on the 3.x branch prior to 3.6.0)
• libparsec_crypto component when compiled with RustCrypto backend

Discovery Timeline

• 2026-01-29 - CVE CVE-2025-62514 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-62514

Vulnerability Analysis

The vulnerability stems from CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). Specifically, the libparsec_crypto component does not implement proper validation checks for weak order points when using Curve25519 elliptic curve cryptography via the RustCrypto backend. In a properly secured implementation, the Diffie-Hellman key exchange should reject points that have low order, as accepting such points can lead to predictable shared secrets.

When weak order points are accepted during the key exchange, the resulting shared secret becomes highly constrained—often to a small set of possible values. An attacker exploiting this vulnerability can enumerate these values, effectively recovering the shared key used to encrypt communications between parties.

Importantly, this vulnerability only affects Parsec Web deployments. The Parsec desktop application uses libparsec_crypto with the libsodium backend, which properly validates curve points and is not vulnerable to this attack.

Root Cause

The root cause lies in missing cryptographic validation within the RustCrypto implementation of the Diffie-Hellman key exchange. The code path at libparsec/crates/crypto/src/rustcrypto/private.rs (lines 136-138) did not include checks to detect and reject weak order points on the Curve25519 curve before computing the shared secret. This is a well-documented attack vector against X25519 implementations that fail to perform contributory behavior checks.

The underlying curve25519-dalek library provides the primitives but relies on implementers to properly handle edge cases. The Parsec implementation failed to leverage the available safeguards, allowing an attacker to supply specially crafted points that result in predictable shared secrets.

Attack Vector

The attack requires a network-level man-in-the-middle position between two parties attempting to establish a secure Parsec session. The attacker intercepts the key exchange messages and substitutes legitimate public keys with weak order points. Both parties then compute their shared secrets based on these malicious points, resulting in predictable key material that the attacker can independently compute.

The attack flow proceeds as follows:

1. Attacker intercepts the initial key exchange between Party A and Party B
2. Attacker replaces the legitimate public keys with weak order points
3. Both parties compute shared secrets that are highly constrained
4. The SAS code verification succeeds because both parties derived matching (but compromised) keys
5. Attacker uses the known key material to decrypt all subsequent communications

// Patch demonstrating the fix in claimer.rs
// Source: https://github.com/Scille/parsec-cloud/commit/197bb6387b49fec872b5e4a04dcdb82b3d2995b2

         timestamp: DateTime,
     },
     #[error(transparent)]
+    CorruptedSharedSecretKey(CryptoError),
+    #[error(transparent)]
     CorruptedConfirmation(DataError),
     #[error("Operation cancelled")]
     Cancelled,

The patch adds a new error type CorruptedSharedSecretKey to handle cases where the shared secret key generation fails validation checks, allowing the application to properly reject invalid key exchange attempts.

Detection Methods for CVE-2025-62514

Indicators of Compromise

• Anomalous network traffic patterns during Parsec Web session establishment
• Multiple failed or retried key exchange attempts from the same session
• Unexpected cryptographic error logs in Parsec Web application logs
• Network interception tools or suspicious ARP spoofing activity on the same network segment

Detection Strategies

• Monitor network traffic for unusual patterns during Parsec Web key exchange sequences
• Implement network intrusion detection rules to identify potential MITM positioning attacks
• Review application logs for cryptographic errors or unexpected key derivation failures
• Deploy SSL/TLS inspection at network boundaries to detect unauthorized certificate substitution

Monitoring Recommendations

• Enable verbose logging for Parsec Web cryptographic operations where available
• Implement network segmentation to reduce MITM attack surface
• Deploy certificate pinning validation for Parsec Web communications
• Monitor for signs of ARP spoofing or DNS poisoning that could enable MITM positioning

How to Mitigate CVE-2025-62514

Immediate Actions Required

• Upgrade Parsec Web to version 3.6.0 or later immediately
• Audit recent Parsec Web sessions for potential compromise if version 3.x prior to 3.6.0 was in use
• Implement network-level protections to detect and prevent MITM attacks
• Consider using Parsec desktop application (which uses libsodium backend) as an interim measure

Patch Information

The vulnerability has been addressed in Parsec version 3.6.0. The fix adds proper contributory behavior checks for the RustCrypto implementation of PrivateKey::generate_shared_secret, ensuring that weak order points are detected and rejected during the Diffie-Hellman key exchange.

The security patch is available via the GitHub commit. Additional details about the vulnerability are documented in the GitHub Security Advisory GHSA-hrc9-gm58-pgj9.

Workarounds

• Use Parsec desktop application instead of Parsec Web, as it uses the libsodium backend which is not affected
• Implement network-level MITM protections such as secure network segmentation and monitoring
• Ensure all Parsec Web sessions occur over trusted, secured network connections
• Consider implementing additional out-of-band verification for sensitive file sharing operations

# Verify Parsec version to ensure patched release
# Check current Parsec Web deployment version
parsec --version
# Ensure version is 3.6.0 or later
# If running vulnerable version, upgrade immediately:
# pip install parsec-cloud>=3.6.0