Pfadüberschreitung in SecureDrop Client API.download_reply()

The impact of this vulnerability is significant, as it allows a compromised SecureDrop Server to execute arbitrary code on the client machine. This could lead to complete compromise of the SecureDrop Client environment, allowing an attacker to steal sensitive data, install malware, or pivot to other systems on the journalist's network. Given SecureDrop's purpose of secure communication, a successful exploitation could expose confidential information and compromise the integrity of journalistic sources and reporting. The SecureDrop Server itself is designed with multiple layers of hardening, but this vulnerability bypasses those protections by exploiting a flaw in the client application.

News organizations and journalists who rely on SecureDrop for secure communication with sources are at significant risk. Specifically, those using older versions of the SecureDrop Client (≤ 0.14.1) and those with configurations where the SecureDrop Server is not adequately secured are particularly vulnerable.

• linux / server: Monitor SecureDrop Server logs for unusual file access attempts or connections to the SecureDrop Client. Use journalctl -f to monitor for suspicious activity.

journalctl -f | grep "sd-app" 

• python: Examine SecureDrop Client application logs for any errors related to file path manipulation or access. • generic web: If the SecureDrop Server exposes any web interfaces, check for unusual file requests or directory traversal attempts in access logs.

1. 2025-02-13Disclosure

   disclosure

1. Reserviert2025-01-27
2. Veröffentlicht2025-02-13
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-24888 is to immediately upgrade the SecureDrop Client to version 0.14.1 or later. Prior to upgrading, it's crucial to back up the client's configuration and data. If upgrading causes compatibility issues, consider rolling back to a previous, known-stable version of the client, but understand this only provides temporary protection. Network segmentation between the SecureDrop Server and Client can limit the potential blast radius. Monitor network traffic for unusual connections between the server and client, looking for attempts to access files outside of expected directories. After upgrading, verify the fix by attempting to access files outside the intended directory from the SecureDrop Server; access should be denied.