The Register: MITRE Caldera security suite scores perfect 10 for insecurity

Feb 25, 2025

—

Source URL: https://www.theregister.com/2025/02/25/10_bug_mitre_caldera/
Source: The Register
Title: MITRE Caldera security suite scores perfect 10 for insecurity

Feedly Summary: Is a trivial remote-code execution hole in every version part of the training, or?
The smart cookie who discovered a perfect 10-out-of-10-severity remote code execution (RCE) bug in MITRE’s Caldera security training platform has urged users to “immediately pull down the latest version." As in, download it and install it.…

AI Summary and Description: Yes

Summary: A critical remote code execution (RCE) vulnerability discovered in MITRE’s Caldera security training platform poses significant risks, affecting all versions released since 2017. The vulnerability’s exploitation can occur in default configurations, underlining urgent remediation actions for users to apply updates or restrict access.

Detailed Description: The recent discovery of a severe remote code execution bug, tracked as CVE-2025-27364, underscores vital security implications for users of MITRE’s Caldera security training platform. This platform is widely used by both red and blue teams for simulating cyber-attacks and fortifying organizational defenses. Here are the key points:

– **Vulnerability Severity**: The bug has been classified as a 10-out-of-10 severity level, indicating a high potential for exploitation that can lead to significant security breaches.
– **Affected Versions**: All versions of Caldera since its initial release in 2017 are impacted, except for the latest fixed versions (5.1.0 and above).
– **Remote Code Execution (RCE)**: The RCE vulnerability can be triggered in most default configurations, allowing attackers to remotely hijack the platform.
– **Dependencies for Exploitation**: Successful exploitation requires the installation of Go, Python, and GCC on the target device, which are common dependencies for functional operations of Caldera.
– **Attack Methodology**: The exploit involves deploying specific agents that can execute commands set by an attacker. The vulnerability is exacerbated by an unauthenticated API endpoint that accepts malicious requests, making it easier for an attacker to exploit the system without valid credentials.
– **Call to Action**: Users have been urged to immediately update to the latest version or restrict their deployments to prevent exposure to untrusted environments.

In addition, another report concerning vulnerabilities in Parallels Desktop for Mac highlights the broader landscape of security flaws that can jeopardize both user systems and organizational workflows. For professionals focused on security, these incidents encapsulate the urgency of maintaining up-to-date software and reinforcing security measures in development environments.

**Recommendations for Security Professionals**:
– **Immediate Action**: Apply the latest patches to Caldera to mitigate the risks associated with the RCE vulnerability.
– **Access Control**: Restrict access to the platform from untrusted networks to reduce exposure risks.
– **Continuous Monitoring**: Implement continuous monitoring solutions to detect and respond to threats that may exploit similar vulnerabilities.

These incidents warrant careful attention from security and compliance professionals to safeguard their infrastructures against emerging threats.

01 1 2 3 4 5 7 a access access control Act actions agent agents AI and API art as attack attack method attack methodology attackers attacks AWS breach breaches Bug by C Caldera CERN CIA class code code execution command compliance compliance professionals Configuration configurations continuous monitoring control core credential credentials critical CVE cyber D de defense defenses dependencies deployment Desktop development development environment development environments e emerging threats end endpoint environment event execution exp exploit Exploitation fault flaws focused for g Gen GIS Go H high Highlight HR http HTTPS implications in incident infrastructure infrastructures installation ite J jack k Key l land law led Li low mac making man media Mila Monitor monitoring monitoring solutions N network networks no o of on operation OPM organization out over Patch patches platform point potential pre professionals Py Python R rack RCE recommendations red release remediation remediation actions Remote Code Execution report Risk risks Ro Rust s safe sec security security and compliance security breach security breaches Security Flaw security flaws security implications security measure security measures security professionals security training severity Sig Sim SoC software solutions source specific structures system systems T Teams test the threat threats to Tor TP training trust two UI unauthenticated up update updates US use user Users uth V val version vulnerabilities vulnerability vulnerability severity Wi workflow workflows x