Description
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Phase Phase Console
Default version status: unaffected
0 to ≤ 2.77.3affected
pkg:github/phasehq/consoleReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyZJ_mjize ↗
- https://github.com/phasehq/console/blob/v2.77.3/backend/backend/schema.py#L1022-L1052 ↗
- https://github.com/phasehq/console/blob/v2.77.3/backend/backend/schema.py#L985-L1009 ↗
- https://github.com/phasehq/console/blob/v2.77.3/backend/api/utils/access/permissions.py#L78-L92 ↗
- https://github.com/phasehq/console ↗
- https://www.vulncheck.com/advisories/phase-console-through-2.77.3-missing-authorization-via-secrethistory-graphql-query ↗