Vulnerability in com.ctrip.framework.apollo:apollo (CVE-2025-32781)
Summary
Vulnerability in com.ctrip.framework.apollo:apollo (CVE-2025-32781). Confidential information can be exposed externally. Exploitable via GET /envs/{env}/releases/{releaseId}.
Original description
The description as published by the source.
Summary
Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId}.
When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can supply a valid release ID belonging to an application or namespace they are not authorized to view. The endpoint returns the release data without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...).
Impact
An authenticated attacker who obtains or guesses a valid release ID can read configuration data from other applications and namespaces. Exposed configuration may contain sensitive values such as credentials or service endpoints. The issue does not allow configuration modification and does not directly affect availability.
Affected versions
Apollo Portal versions earlier than 2.5.0 are affected when configView.memberOnly.envs is enabled.
Patches
The issue is fixed in Apollo 2.5.0. The fix adds the missing application and namespace permission check before returning release data.
- Fix: https://github.com/apolloconfig/apollo/pull/5378
- Fix commit: https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
- Patched release: https://github.com/apolloconfig/apollo/releases/tag/v2.5.0
Workarounds
Upgrade to Apollo 2.5.0 or later. If an immediate upgrade is not possible, backport the permission check fro…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2025-32781 has been found in com.ctrip.framework.apollo:apollo.
Attackers can target a specific entry point like GET /envs/{env}/releases/{releaseId} over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 6.5/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "com.ctrip.framework.apollo:apollo CVE-2025-32781" on the vendor's site.
CVE-2025-32781 (com.ctrip.framework.apollo:apollo) — CWE-639 / CVSS v3 6.5
Attack vector: remote (network-reachable) / no user interaction
Attack surface: GET /envs/{env}/releases/{releaseId} / configView.memberOnly.envs
Workaround: Upgrade to Apollo 2.5.0 or later.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-639) exists in com.ctrip.framework.apollo:apollo. Attackers reach the vulnerable code path via GET /envs/{env}/releases/{releaseId}.
Check the vendor advisory for the affected versions of com.ctrip.framework.apollo:apollo. Attack surface: GET /envs/{env}/releases/{releaseId} / configView.memberOnly.envs.
Severity: Medium (CVSS 6.5/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Workaround: Upgrade to Apollo 2.5.0 or later.
Search webserver/proxy logs for unusual GET /envs/{env}/releases/{releaseId} requests with malformed payloads or SQL meta-characters. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで com.ctrip.framework.apollo:apollo を使っているサービスとバージョンを洗い出す。
-
2Hunt for indicators of compromise detect
grep 'GET /envs/{env}/releases/{releaseId}' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
GET /envs/{env}/releases/{releaseId}への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Apply temporary workaround mitigate
Upgrade to Apollo 2.5.0 or later.パッチが適用されるまでの応急処置として、Upgrade to Apollo 2.5.0 or later. を実施。回避策の副作用 (機能低下) を確認した上で。
-
4Post-deployment verification verify
Replay attack against GET /envs/{env}/releases/{releaseId} on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com