Listen to this Post
The vulnerability CVE-2025-64650 operates within IBM Storage Defender – Resiliency Service versions 2.0.0 through 2.0.18. This service inadvertently writes sensitive user authentication credentials into its system log files during normal operations. The logging mechanism captures detailed data from user interactions and API requests without proper filtration. Sensitive fields like usernames and passwords are included in log entries intended for debugging. This occurs due to insufficient security controls in the logging code configuration. The service does not redact or mask confidential information before output. Credentials are stored in plain text within various log files on the filesystem. Log files are often stored in directories with standard read permissions. Unauthorized users or processes with system access can read these files. Attackers do not need high privileges to access these logs locally. If logs are exposed through administrative interfaces, remote access is possible. The primary flaw is the failure to exclude credentials from log outputs. This type of information disclosure is common in verbose logging setups. Log rotation may archive files containing historical credentials. An attacker exploits this by locating and extracting credentials from logs. Retrieved credentials can compromise the Storage Defender service directly. This access may lead to unauthorized data manipulation or extraction. It also enables lateral movement within the integrated storage environment. The risk escalates if logs are accessible via network shares or backups. IBM addressed this by modifying logging practices in later updates.
Platform: IBM Storage Defender
Version: 2.0.0-2.0.18
Vulnerability: Credential log disclosure
Severity: Not specified
date: 12/08/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
grep -i “password\|auth” /var/log/ibm_defender/.log
find /opt/ibm/ -name “.log” -exec grep -l “secret” {} \;
cat /path/to/service.log | grep -E “user.pass|credential”
how Exploit:
Attacker gains read access to log file directories. They search log contents for credential patterns using simple commands. Extracted plain-text credentials are used for authenticating to the service.
Protection from this CVE
Apply IBM update beyond version 2.0.18. Configure logging to redact sensitive fields. Restrict read permissions on log directories and files.
Impact:
Disclosure of administrative credentials. Unauthorized access to storage management systems. Potential data breach and system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
