{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ml-logger--commit-acf255bade5be6ad88d90735c8367b28cbe3a743/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:geyang:ml-logger:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2025-10952"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ml-logger (\u003c= commit acf255bade5be6ad88d90735c8367b28cbe3a743)"],"_cs_severities":["high"],"_cs_tags":["arbitrary-file-read","path-traversal","webserver"],"_cs_type":"advisory","_cs_vendors":["Geyang"],"content_html":"\u003cp\u003eCVE-2025-10952 is a critical vulnerability residing in the \u003ccode\u003eml-logger\u003c/code\u003e Python library, specifically within the \u003ccode\u003estream_handler\u003c/code\u003e component of \u003ccode\u003eml_logger/server.py\u003c/code\u003e. The flaw stems from improper input validation where the \u003ccode\u003ekey\u003c/code\u003e parameter, provided via JSON request body, is passed directly to file read operations without adequate sanitization or path restriction checks. An unauthenticated attacker can exploit this by sending specially crafted paths, such as those utilizing double leading slashes (e.g., \u003ccode\u003e//root/.ssh/id_rsa\u003c/code\u003e), to bypass intended directory constraints. This enables the attacker to read arbitrary files accessible by the system user running the \u003ccode\u003eml-logger\u003c/code\u003e process. A functional proof-of-concept exploit is publicly available, enabling unauthenticated file enumeration via the \u003ccode\u003e/glob\u003c/code\u003e endpoint followed by arbitrary file exfiltration through the \u003ccode\u003e/stream\u003c/code\u003e endpoint.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target exposing the \u003ccode\u003eml-logger\u003c/code\u003e API, typically on port 8081.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to the \u003ccode\u003e/glob\u003c/code\u003e endpoint to enumerate the filesystem and identify sensitive files.\u003c/li\u003e\n\u003cli\u003eAttacker parses the JSON response from the \u003ccode\u003e/glob\u003c/code\u003e endpoint to locate high-value targets like SSH keys, configuration files, or credentials.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious request to the \u003ccode\u003e/stream\u003c/code\u003e endpoint, embedding the targeted file path into the \u003ccode\u003ekey\u003c/code\u003e JSON field.\u003c/li\u003e\n\u003cli\u003eAttacker prepends double slashes (e.g., \u003ccode\u003e//etc/shadow\u003c/code\u003e) to the file path to bypass the application's path normalization logic.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eml-logger\u003c/code\u003e service retrieves the requested file from the disk and transmits the content to the attacker in the response body.\u003c/li\u003e\n\u003cli\u003eAttacker saves the exfiltrated content, such as a private SSH key, to their local machine.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen credentials to establish persistent access or move laterally within the victim environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read sensitive files from the underlying host filesystem. This poses a severe risk of credential theft, including the acquisition of SSH private keys, environment variables, and configuration files containing secrets. If the \u003ccode\u003eml-logger\u003c/code\u003e service is running with elevated privileges, the impact extends to full system compromise. The vulnerability affects all versions of \u003ccode\u003egeyang/ml-logger\u003c/code\u003e up to commit \u003ccode\u003eacf255bade5be6ad88d90735c8367b28cbe3a743\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement an authentication-enabled reverse proxy or API gateway in front of all \u003ccode\u003eml-logger\u003c/code\u003e instances to restrict access to trusted sources.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect path traversal attempts targeting the \u003ccode\u003eml-logger\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict the operating system user account running \u003ccode\u003eml-logger\u003c/code\u003e to the minimum necessary permissions to prevent access to sensitive files like \u003ccode\u003e~/.ssh/\u003c/code\u003e or \u003ccode\u003e/etc/shadow\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpgrade to a patched version of \u003ccode\u003eml-logger\u003c/code\u003e as soon as the vendor provides a formal release addressing the vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T19:44:16Z","date_published":"2026-10-16T19:44:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ml-logger-afr/","summary":"An unauthenticated arbitrary file read vulnerability (CVE-2025-10952) in the ml-logger stream_handler allows remote attackers to enumerate and exfiltrate sensitive files from the host filesystem.","title":"Unauthenticated Arbitrary File Read in ml-logger via CVE-2025-10952","url":"https://feed.craftedsignal.io/briefs/2026-10-ml-logger-afr/"}],"language":"en","title":"CraftedSignal Threat Feed - Ml-Logger (\u003c= Commit Acf255bade5be6ad88d90735c8367b28cbe3a743)","version":"https://jsonfeed.org/version/1.1"}