CVE-2025-54872

onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the secrets were copied from an existing onion domain. A website could be compromised if a user shared the baked-in image, or if someone were able to acquire access to the user's device outside of a containerized environment. This is fixed by commit bc9ba0fd.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84
https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55

Configurations

No configuration.

History

06 Aug 2025, 20:23

Type	Values Removed	Values Added
Summary		(es) onion-site-template es una muestra completa, escalable y autoalojada de un servicio oculto de Tor. Las versiones que incluyen el commit 3196bd89 contienen una imagen de Tor preinstalada si los secretos se copiaron de un dominio onion existente. Un sitio web podría verse comprometido si un usuario compartiera la imagen preinstalada o si alguien pudiera acceder al dispositivo del usuario fuera de un entorno contenedorizado. Esto se solucionó con el commit bc9ba0fd.

06 Aug 2025, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-06 00:15

Updated : 2025-08-06 20:23

NVD link : CVE-2025-54872

Mitre link : CVE-2025-54872

CVE.ORG link : CVE-2025-54872

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-54872", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-06T00:15:31.357", "references": [{"url": "https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84", "source": "security-advisories@github.com"}, {"url": "https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the secrets were copied from an existing onion domain. A website could be compromised if a user shared the baked-in image, or if someone were able to acquire access to the user's device outside of a containerized environment. This is fixed by commit bc9ba0fd."}, {"lang": "es", "value": "onion-site-template es una muestra completa, escalable y autoalojada de un servicio oculto de Tor. Las versiones que incluyen el commit 3196bd89 contienen una imagen de Tor preinstalada si los secretos se copiaron de un dominio onion existente. Un sitio web podr\u00eda verse comprometido si un usuario compartiera la imagen preinstalada o si alguien pudiera acceder al dispositivo del usuario fuera de un entorno contenedorizado. Esto se solucion\u00f3 con el commit bc9ba0fd."}], "lastModified": "2025-08-06T20:23:52.133", "sourceIdentifier": "security-advisories@github.com"}