CVE-2025-54389
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-11-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| advanced_intrusion_detection_environment_project | advanced_intrusion_detection_environment | to 0.19.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-117 | The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in AIDE prior to version 0.19.2 involves improper output neutralization. An attacker can craft malicious filenames containing terminal escape sequences that can hide the addition or removal of files from AIDE's report or tamper with the log output. This allows a local user to potentially bypass AIDE's detection of malicious files. Additionally, extended attribute key names and symbolic link targets are also not properly neutralized, contributing to the issue.
How can this vulnerability impact me? :
The vulnerability can allow a local attacker to evade detection by AIDE, an intrusion detection system, by hiding changes to files or tampering with log outputs. This means malicious files could be added or removed without being detected, potentially compromising system integrity and security monitoring.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper output neutralization in AIDE prior to version 0.19.2, allowing an attacker to craft malicious filenames with terminal escape sequences to tamper with log outputs. Detection would involve inspecting AIDE reports and logs for suspicious escape sequences or anomalies in file addition/removal entries. However, no specific detection commands are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade AIDE to version 0.19.2 or later where the issue is patched. As a workaround, configure AIDE to write report output to a regular file, redirect stdout to a regular file, or redirect log output written to stderr to a regular file to avoid terminal escape sequence exploitation.