Local Admin Password Disclosure via Browser Cache in LAPSWebUI

Executive Summary

CVE-2025-15554 is a vulnerability in truesec’s LAPSWebUI versions before 2.4 where local administrator passwords are cached by web browsers due to missing Cache-Control HTTP headers in server responses.

Specifically, the GET /Home/Password endpoint returns HTML containing sensitive local admin passwords without instructing browsers or proxies not to cache this data. As a result, browsers like Mozilla Firefox store these passwords locally, which can be accessed by an attacker with access to the workstation.

This vulnerability allows an attacker who can access a workstation to escalate their privileges by retrieving cached local admin passwords.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to privilege escalation on affected systems.

An attacker with access to a workstation can retrieve cached local administrator passwords from the browser cache, allowing them to gain higher privileges than originally permitted.

This increases the risk of unauthorized administrative access, potentially compromising system security and sensitive data.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the HTTP responses from the LAPSWebUI server, specifically the GET /Home/Password endpoint, lack the Cache-Control header that prevents caching of sensitive data.

You can inspect the HTTP headers returned by the server using command-line tools such as curl or wget.

• Use curl to check headers: curl -I https://<lapswebui-server>/Home/Password
• Look for the absence of the Cache-Control header or presence of headers that allow caching.
• Additionally, check browser cache directories (e.g., Firefox cache on Linux) for cached password data related to LAPSWebUI.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade truesec’s LAPSWebUI to version 2.4 or later, which fixes the issue by preventing caching of sensitive password pages.

If immediate upgrade is not possible, configure your web server to include the HTTP header: Cache-Control: no-store on the sensitive endpoints such as /Home/Password to prevent browsers and proxies from caching the passwords.

Also, restrict physical and local access to workstations to reduce the risk of attackers accessing cached passwords.

Useful 0 Not Useful 0