orion-visor v2.5.7 Hardcoded Token Auth Bypass (CWE-798, CVSS 9.8)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: ExpozeApi hardcoded default token authentication bypass (CWE-798) Vulnerability Type: Hardcoded credentials / Authentication bypass Root Cause: The annotation is annotated with the meta-annotation, causing Spring Security to skip authentication for these endpoints. Authentication logic is delegated to , which performs a simple string comparison between the token in the request header and the configured token (default value ). Trigger Condition: When the environment variable is not overridden, any remote attacker aware of this publicly visible default token can bypass authentication to access endpoints. Affected Scope Affected Products: - Ecosystem: self-hosted - Package name: orion-visor - Affected versions: v2.5.7 - Fixed version: To be confirmed Affected Endpoints: lines 64-97 ( , , ) and lines 59-76 ( , ). Impact: A remote, unauthenticated attacker can use the publicly visible default token to manipulate host agent state, forge heartbeats, and inject forged monitoring and host specification data. Severity: CVSS v3.1 score 9.8 (Critical), vector . POC / Exploitation Code Remediation 1. Remove the hardcoded default token from the configuration. 2. Enforce setting at startup. 3. Generate a unique random token as the default value for each instance. 4. Consider enabling TLS or using JWT tokens. 5. Notify users to rotate their tokens. Additional Information CWE: CWE-798 (Hardcoded Credentials) Disclosure Note: The token is publicly visible in the open-source repository and was found through code audit; v2.5.7 is confirmed affected, and the patch timeline is pending. Project URL: https://github.com/dronama/orion-visor Reporter: sumo166 (Email: syngot5@gmail.com, GitHub: https://github.com/sumo166, Web ID: summm)

Goal Reached Thanks to every supporter — we hit 100%!

orion-visor v2.5.7 Hardcoded Token Auth Bypass (CWE-798, CVSS 9.8)

More from this source