N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62513

CVE-2025-62513: OpenBao leaks HTTPRawBody in Audit Logs

Impact

OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacted the following subsystems:

When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.
When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.

Third-party plugins may be affected.

Patches

OpenBao v2.4.2 will patch this issue.

Workarounds

If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62513

CVE-2025-62513:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao	go	>= 0.0.0-20241114205727-b1235e585db7, < 0.0.0-20251022165510-cc2c476bac66	0.0.0-20251022165510-cc2c476bac66

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-ghfh-fmx4-26h8, lies in OpenBao's audit logging system. Specifically, the system failed to properly redact (HMAC) the HTTPRawBody field in audit logs for certain endpoints, such as those used by the ACME and OIDC features. This resulted in the leakage of potentially sensitive information, like ACME challenge codes and OIDC claims, into the audit logs.

The root cause of the vulnerability was a flawed and overly complex implementation of the data hashing mechanism within the audit package. The system used a two-copy approach, where it would traverse an original data structure while attempting to modify a separate, JSON-unmarshaled copy. This process was error-prone and failed to correctly handle fields of type []byte, such as HTTPRawBody.

The patch addresses this by refactoring the entire hashing logic. The key change was to abandon the two-copy approach in favor of operating on a single data structure. This simplification is evident in the changes to the HashResponse, HashStructure, and hashMap functions in audit/hashstructure.go.

audit.HashResponse is the primary function responsible for preparing the response for logging. It was failing to ensure HTTPRawBody was in a hashable format. audit.HashStructure contained the buggy recursive logic. By identifying these functions, we can pinpoint the exact locations in the code that would be exercised during the exploitation of this vulnerability, making them key indicators in a runtime profile.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62513: OpenBao leaks HTTPRawBody in Audit Logs

Impact

Patches

Workarounds

CVE-2025-62513:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Basic Information

Basic Information

Technical Details

CVE-2025-62513: OpenBao leaks HTTPRawBody in Audit Logs

Impact

Patches

Workarounds

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI