Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-54471

CVE-2025-54471: NeuVector is shipping cryptographic material into its binary

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-54471
GHSA ID
GHSA-h773-7gf7-9m2x
EPSS Score
-
CWE
CWE-321
Published
10/21/2025
Updated
10/21/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/neuvector/neuvectorgo>= 5.3.0, <= 5.4.65.4.7
github.com/neuvector/neuvectorgo>= 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b40.0.0-20251020133207-084a437033b4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability, identified as GH-SA-h773-7gf7-9m2x, stems from NeuVector's use of a hard-coded cryptographic key for encrypting sensitive configurations and user tokens. My analysis of the provided patch commit 084a437033b491eeea11bdba1a09dd84ed12ea88 confirms this. The core of the issue lies in functions that performed encryption and decryption using a static, predictable key.

The patch introduces a new, more secure method of handling encryption keys by dynamically generating them and storing them in Kubernetes secrets. The new implementation uses AES-GCM, a modern and secure encryption algorithm.

I have identified the following key functions as vulnerable because they were either directly using the hardcoded key or were responsible for orchestrating the vulnerable encryption/decryption process:

  1. common.(*EncryptMarshaller).Marshal: This function and its internal helpers were responsible for encrypting configuration data before persisting it. The patch reveals that it would fall back to using utils.EncryptPassword, the old method that relied on the hardcoded key.
  2. common.(*DecryptUnmarshaller).Unmarshal and Uncloak: These functions were responsible for decrypting configuration data. The patch explicitly shows logic to handle data encrypted with the old method (utils.DecryptPassword), proving the existence and use of the weak encryption.
  3. utils.EncryptUserToken and utils.DecryptUserToken: These functions were specifically used for handling user authentication tokens. The code changes clearly show the removal of a call to getPasswordSymKey(), which is where the hardcoded key was likely sourced from.

These functions would be the primary indicators in a runtime profile if the vulnerability were to be triggered. For example, during login or when sensitive configuration is saved or loaded, these functions would be on the call stack. The patch mitigates the vulnerability by replacing the static key with a dynamic key management system, significantly improving the security of the stored data.

Vulnerable functions

github.com/neuvector/neuvector/controller/common.(*EncryptMarshaller).Marshal
controller/common/marshal.go
This function is responsible for encrypting data before it is stored. The patch shows that it previously used `utils.EncryptPassword`, which relied on a hardcoded key. The new implementation uses `aesGcmEncrypt` with a dynamically generated key, but falls back to the vulnerable `utils.EncryptPassword` if the new key is not available. An attacker could potentially force a fallback to the weak encryption method.
github.com/neuvector/neuvector/controller/common.(*DecryptUnmarshaller).Unmarshal
controller/common/marshal.go
This function is responsible for decrypting data when it is read from storage. The patch shows that it contains logic to decrypt data that was encrypted with the old, vulnerable method (`utils.DecryptPassword`). This confirms that the system was using a weak, static encryption key.

WAF Protection Rules

WAF Rule

### Imp**t N*uV**tor us** * **r*-*o*** *rypto*r*p*i* k*y *m****** in t** sour** *o**. *t *ompil*tion tim*, t** k*y v*lu* w*s r*pl**** wit* t** s**r*t k*y v*lu* *n* us** to *n*rypt s*nsitiv* *on*i*ur*tions w**n N*uV**tor stor*s t** **t*. In t** p*t*

Reasoning

T** vuln*r**ility, i**nti*i** *s **-S*-****-****-*m*x, st*ms *rom N*uV**tor's us* o* * **r*-*o*** *rypto*r*p*i* k*y *or *n*ryptin* s*nsitiv* *on*i*ur*tions *n* us*r tok*ns. My *n*lysis o* t** provi*** p*t** *ommit `***********************************