Read the docs
TI-2025-18851 Aliases CVE-2025-25182

Stroom Authentication/Authorization Bypass when using AWS ALB

Priority MEDIUM 50CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution or further privileges escalations when using the AWS metadata URL. This scenario assumes that Stroom must be configured to use ALB Authentication integration and the application is network accessible. The vulnerability has been fixed in versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed stroom (gchq): 7.2.24, 7.3-beta.22, 7.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gchqstroom7.2-beta.53 to before 7.2.24; = 7.5-beta.1; 7.3-beta.1 to before 7.3-beta.22; 7.4-beta.1 to before 7.4.47.2.24, 7.3-beta.22, 7.4.4Patch availableCNA
  • stroom Vendorgchq Affected 7.2-beta.53 to before 7.2.24; = 7.5-beta.1; 7.3-beta.1 to before 7.3-beta.22; 7.4-beta.1 to before 7.4.4 Fixed in 7.2.24, 7.3-beta.22, 7.4.4 Patch available CNA

Remediation

  • Fix · CNA stroom (gchq) Fixed in 7.2.24, 7.3-beta.22, 7.4.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25182

References

Other 2

  • TI-2026-41376 CyberChef: Prototype pollution in Series Chart operation CVSS 3.1MEDIUM 5.0
  • TI-2018-16004 Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser… CVSS 3.0CRITICAL 10.0
  • TI-2026-30894 Cross-site scripting in gchq CyberChef CVSS 3.1HIGH 7.2
  • TI-2019-11632 CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. CVSS 3.0MEDIUM 6.1
  • TI-2019-08044 Cross-site scripting in stroom:stroom-app CVSS 3.1MEDIUM 6.1
  • TI-2026-51128 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences