CVE-2025-64185: Open OnDemand Privilege Escalation Flaw

CVE-2025-64185 Overview

CVE-2025-64185 affects Open OnDemand, an open-source High Performance Computing (HPC) portal used to provide web-based access to HPC resources. The vulnerability stems from Open OnDemand packages creating world-writable locations within the GEM_PATH directory. Any local user on a system hosting Open OnDemand can modify files in these directories. This introduces a code integrity risk on shared HPC systems where privileged Ruby gem code is loaded from paths any user can write to. Versions prior to 4.0.8 and 3.1.16 are affected, and both branches have received patches. The issue is classified under CWE-277: Insecure Inherited Permissions.

Critical Impact
World-writable directories in GEM_PATH allow local users to tamper with Ruby gem files loaded by Open OnDemand, undermining integrity of the HPC portal runtime.

Affected Products

Open OnDemand versions prior to 3.1.16 (3.x branch)
Open OnDemand versions prior to 4.0.8 (4.x branch)
HPC systems using packaged Open OnDemand distributions

Discovery Timeline

2025-11-20 - CVE-2025-64185 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64185

Vulnerability Analysis

Open OnDemand ships Ruby gem content on disk under paths referenced by the GEM_PATH environment variable. The packaged installers configure some of those locations with world-writable permissions. Any authenticated local user on the host can therefore modify gem files, cache entries, or supporting artifacts under those paths. Because Open OnDemand loads gems from GEM_PATH when serving web requests, tampered files execute in the context of the service user handling portal operations. The Open OnDemand maintainers addressed the issue in versions 4.0.8 and 3.1.16 by correcting permissions on packaged locations.

Root Cause

The root cause is insecure inherited permissions on directories created during package installation. The packaging scripts set world-writable modes on paths within GEM_PATH that should remain owned and writable only by root or the Open OnDemand service account. This violates the principle of least privilege for filesystem permissions and matches the pattern described by CWE-277.

Attack Vector

An attacker with local shell access to an Open OnDemand host writes malicious Ruby content into a world-writable GEM_PATH location. When Open OnDemand loads gems from that directory during normal operation, the attacker-controlled code runs under the portal's service context. On multi-tenant HPC login nodes, this converts a low-privileged shell account into a foothold against the portal service. Exploitation does not require network access to a vulnerable interface, only prior local access to the host. Refer to the GitHub Security Advisory GHSA-r2cg-hg78-gq9p for maintainer guidance.

Detection Methods for CVE-2025-64185

Indicators of Compromise

Unexpected file modifications or new files inside directories referenced by GEM_PATH on Open OnDemand hosts.
Ruby source files under gem directories owned by non-root, non-service users.
Open OnDemand service processes spawning unusual child processes shortly after gem load events.

Detection Strategies

Audit filesystem permissions on all GEM_PATH locations and flag any directory or file with world-writable (o+w) mode.
Enable filesystem integrity monitoring on Open OnDemand gem directories to alert on writes by non-privileged accounts.
Correlate local user shell activity with modifications to Open OnDemand installation paths through host telemetry.

Monitoring Recommendations

Ingest Linux audit logs covering open, write, and chmod events on Open OnDemand package directories.
Track process execution lineage from the Open OnDemand service account to identify unexpected code paths after a gem write.
Baseline the expected owner, group, and mode of every path enumerated by gem env and alert on drift.

How to Mitigate CVE-2025-64185

Immediate Actions Required

Upgrade Open OnDemand to version 4.0.8 on the 4.x branch or 3.1.16 on the 3.x branch.
Inventory all directories in GEM_PATH on Open OnDemand hosts and remove world-writable permissions.
Review recent file modifications in gem directories for signs of tampering before upgrading.

Patch Information

Open OnDemand versions 4.0.8 and 3.1.16 remediate the world-writable GEM_PATH locations. Install the fixed package from the vendor repository and restart the Open OnDemand service. See the GitHub Security Advisory GHSA-r2cg-hg78-gq9p for release notes and upgrade guidance.

Workarounds

Manually remove world-writable permissions on affected GEM_PATH directories using chmod o-w until packages are upgraded.
Restrict local login access on Open OnDemand hosts to trusted administrators where feasible.
Enable filesystem integrity monitoring on Open OnDemand installation paths to detect unauthorized modification.

bash

# Configuration example: identify and correct world-writable paths in GEM_PATH
for d in $(gem env gempath | tr ':' ' '); do
  find "$d" -perm -o+w -print
done

# Remove world-writable bit from affected paths
for d in $(gem env gempath | tr ':' ' '); do
  find "$d" -perm -o+w -exec chmod o-w {} +
done