PT-2025-27002 · Github · Octo-Sts

Vicevirus · Published 2025-06-26 · Updated 2025-08-04 · CVE-2025-52477

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Octo-STS versions prior to v0.5.3

Description: Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. The issue allows for unauthenticated Server-Side Request Forgery (SSRF) by abusing fields in OpenID Connect tokens. Malicious tokens can trigger internal network requests, which could reflect error logs containing sensitive information.

Recommendations: Upgrade to v0.5.3 to resolve this issue, as this version includes patch sets to sanitize input and redact logging.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-52477

GHSA-H3QP-HWVR-9XCQ

GO-2025-3779

OPENSUSE-SU-2025:15405-1

Affected Products

Octo-Sts

References · 69

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52477.json · Exploit
• https://osv.dev/vulnerability/GHSA-h3qp-hwvr-9xcq · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52477 · Security Note
• https://osv.dev/vulnerability/GO-2025-3779 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52477 · Vendor Advisory
• https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd · Note
• https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92 · Note
• https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq · Note
• https://github.com/octo-sts/app · Note
• https://suse.com/security/cve/CVE-2025-46702 · Note
• https://suse.com/security/cve/CVE-2024-44906 · Note
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://suse.com/security/cve/CVE-2025-53633 · Note
• https://suse.com/security/cve/CVE-2025-47943 · Note