Chef Automate CVE-2025-8868

Exploitation targets the compliance service of Chef Automate on the Linux x86 platform, versions earlier than 4.13.295. The concrete prerequisite stated in the description is authenticated access combined with a 'well-known token' that the attacker supplies to reach restricted compliance-service functionality, where improperly neutralized inputs are passed into an SQL command. Limiting factors: the vulnerability is confined to the Linux x86 build and to versions below 4.13.295 (patched releases are not affected), and per CVSS the attacker needs at least low privileges (PR:L); however, the reliance on a 'well-known' token likely weakens that authentication barrier substantially, so defenders should not treat PR:L as a strong mitigating control.

This is a credible operational priority rather than a paper-high CVSS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection (CWE-89) requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the compliance service. Three independent signals reinforce each other: a publicly available exploit exists, the patch is vendor-confirmed, and EPSS is 17.32% at the 95th percentile - an unusually high exploitation-probability ranking indicating this CVE is among the most likely to see activity. The description's phrase 'using a well-known token' is the key nuance: although CVSS encodes PR:L (authenticated), a well-known/default token can in practice collapse that barrier close to unauthenticated access, so real-world risk may exceed what PR:L implies - verify the token's nature with Progress. There is NO CISA KEV listing in the input, so despite the high EPSS and public POC, there is no confirmation of active in-the-wild exploitation; treat this as high exploitation likelihood, not confirmed exploitation. Net: patch promptly given POC + high EPSS + full-impact SQLi.

An attacker with low-privilege authenticated access (or possession of the documented well-known token) sends crafted input to the Chef Automate compliance service that is improperly neutralized within an SQL command, injecting attacker-controlled SQL. A public exploit is already available, and because the attack is network-based and low-complexity, the attacker reads or manipulates compliance database contents and reaches restricted functionality, compromising confidentiality, integrity, and availability.