Chef Automate SQLi: When your compliance engine becomes a backdoor
Over the weekend, the CrowdSec Network observed a surge in exploitation attempts targeting CVE-2025-8868 in Chef Automate. CVE-2025-8868 is a vulnerability that allows authenticated attackers to manipulate the database powering the compliance service. The CVSS score for the vulnerability ranges between 8.8 and 9.8, making it a highly critical issue. CrowdSec intelligence has detected around 70 distinct IPs probing for this vulnerability. The vulnerability affects all versions of Chef Automate before 4.13.295.
Key findings
The vulnerability was released on the 29th of September, with CrowdSec adding tracking for it on the 15th of October
Exploitation attempts have been discovered almost immediately after the release of the detection rule, with attacks showing no sign of stopping.
Despite requiring authentication, attackers are actively looking for vulnerable systems. This suggests that there might be vulnerable known credentials or other vulnerabilities available to weaponize the CVE.
What is Chef Automate
Chef is an enterprise software suite for infrastructure management. It allows DevOps professionals to automate and monitor infrastructure deployments and provides streamlined processes for compliance and auditing. Chef Automate is a component of this suite. It provides a simple monitoring dashboard for security compliance and auditing on the other Chef components.
...
