CVE-2025-64348: Elog_project Elog RCE Vulnerability

CVE-2025-64348 Overview

CVE-2025-64348 affects ELOG, an electronic logbook application maintained by the elog_project. The vulnerability allows an authenticated user to modify or overwrite the ELOG configuration file, resulting in denial of service. When the execute facility is enabled with the -x command line flag, attackers can leverage the configuration write primitive to execute operating system commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration, which limits exposure for standard deployments. The underlying weakness is classified as missing authorization [CWE-862].

Critical Impact

Authenticated attackers can overwrite ELOG configuration files to trigger denial of service, and can achieve OS command execution when the -x flag is set.

Affected Products

• ELOG (elog_project:elog) prior to the patched commits
• ELOG instances exposing authenticated network access
• ELOG deployments started with the -x execute facility flag

Discovery Timeline

• 2025-10-31 - CVE-2025-64348 published to the National Vulnerability Database
• 2026-04-26 - Last updated in NVD database

Technical Details for CVE-2025-64348

Vulnerability Analysis

ELOG fails to enforce sufficient authorization checks on operations that write to the application configuration file. Any authenticated user can submit requests that modify or overwrite configuration parameters intended for administrative control. Corrupting the configuration file disrupts ELOG service availability, producing a denial of service condition for legitimate users.

The impact escalates when administrators launch ELOG with the -x flag, which enables the execute facility. In that mode, configuration entries can reference shell commands tied to logbook events. An attacker who controls configuration content can therefore introduce attacker-defined commands that ELOG will execute on the host. The result is command execution under the privileges of the ELOG process.

Root Cause

The root cause is a missing authorization control [CWE-862] on configuration-modification code paths. ELOG treats authenticated session state as sufficient to perform privileged configuration changes rather than validating that the requesting user holds administrative rights. The two upstream fixes are tracked in commits 7092ff64f6eb9521f8cc8c52272a020bf3730946 and f81e5695c40997322fe2713bfdeba459d9de09dc.

Attack Vector

The attack vector is network-based and requires low privileges, specifically a valid authenticated session. No user interaction is required. An attacker sends crafted requests to the ELOG service to overwrite configuration content, then either waits for ELOG to fail on next read or, in -x mode, triggers the configured command path to invoke arbitrary OS commands. See the CVE-2025-64348 record and the CISA CSAF advisory for additional context.

Detection Methods for CVE-2025-64348

Indicators of Compromise

• Unexpected modification timestamps on the ELOG configuration file (elogd.cfg) outside administrative change windows.
• ELOG service restarts or crashes immediately following authenticated HTTP requests from non-administrative accounts.
• New or modified Execute directives within elogd.cfg referencing shell commands when -x is enabled.
• Child processes spawned by the elogd daemon that execute shell interpreters or system utilities.

Detection Strategies

• Monitor file integrity on elogd.cfg and alert on any write event not associated with an administrator session.
• Correlate authenticated ELOG HTTP requests with subsequent configuration file writes to identify unauthorized configuration changes.
• Inspect ELOG process trees for unexpected child processes, particularly /bin/sh, bash, cmd.exe, or powershell.exe.

Monitoring Recommendations

• Enable verbose ELOG access logging and forward logs to a centralized analytics platform for review.
• Track command-line arguments of the elogd process to detect when the -x execute facility is enabled.
• Baseline normal ELOG configuration content and alert on diff events that introduce execution directives.

How to Mitigate CVE-2025-64348

Immediate Actions Required

• Upgrade ELOG to a build that includes the fixes from commits 7092ff64f6eb9521f8cc8c52272a020bf3730946 and f81e5695c40997322fe2713bfdeba459d9de09dc.
• Audit running ELOG processes and remove the -x flag unless the execute facility is strictly required.
• Restrict ELOG access to trusted networks and require strong authentication for all logbook accounts.
• Review elogd.cfg for unauthorized changes and restore from a known-good backup if tampering is detected.

Patch Information

The maintainers addressed the issue in two upstream commits hosted on Bitbucket: Bitbucket commit 7092ff64 and Bitbucket commit f81e5695. Operators should rebuild or update to a release that contains both commits and restart the elogd service.

Workarounds

• Run ELOG without the -x command line flag to prevent OS command execution via configuration entries.
• Disable self-registration and limit logbook accounts to trusted, audited users.
• Place the ELOG configuration file on a read-only filesystem mount where supported by the deployment.
• Front ELOG with a reverse proxy that enforces administrator role checks on configuration endpoints.

# Configuration example
# Start elogd without the execute facility and bind to localhost only
elogd -p 8080 -n 127.0.0.1

# Lock down configuration file permissions
chown root:elog /etc/elogd.cfg
chmod 640 /etc/elogd.cfg