EUVD-2025-17553
GHSA-hxvr-gg2w-j48x
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.
AnalysisAI
Sensitive data exposure vulnerability in Lablup's BackendAI that allows authenticated attackers with high privileges to retrieve user credentials from active sessions on the management platform. The vulnerability affects the session management mechanism and has a CVSS score of 8.0 with a complex attack vector requiring high privilege access, indicating a serious but not trivially exploitable issue in production environments.
Technical ContextAI
This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), which indicates improper access controls or inadequate data protection mechanisms within BackendAI's session management layer. The root cause likely stems from insufficient encryption, improper session isolation, or exposure of credential data in memory/logs accessible to privileged users. BackendAI is Lablup's cloud-native HPC and AI orchestration platform that manages multi-tenant workloads; the vulnerability specifically impacts the management platform's authentication and session handling components. The exposure occurs within active sessions, suggesting that session tokens, API keys, or user credentials are being stored or transmitted in a manner that allows unauthorized retrieval by authenticated administrative users.
RemediationAI
- IMMEDIATE: Contact Lablup for security advisory and patch availability for CVE-2025-49653; 2) If patch available: upgrade BackendAI to the patched version immediately for multi-tenant or high-sensitivity deployments; 3) INTERIM MITIGATIONS (if patch unavailable): restrict administrative access to BackendAI management platform to essential personnel only, implement additional access logging and monitoring on credential-related API endpoints, rotate all user credentials and API keys post-remediation, enforce session timeout policies to minimize active session window, consider network segmentation to limit access to the management platform; 4) VERIFICATION: after patching, audit session management logs for unauthorized credential access and verify session isolation mechanisms are functioning correctly.
Share
External POC / Exploit Code
Leaving vuln.today