Description
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
smartloli EFAK
Default version status: unaffected
5.0.0 to ≤ 5.1.0affected
pkg:github/smartloli/EFAKReferences
- https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api ↗
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/ModelConfigController.java#L34-L56 ↗
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93 ↗
- https://github.com/smartloli/EFAK ↗
- https://www.vulncheck.com/advisories/efak-5.0.0-through-5.1.0-missing-authorization-via-api-model-config-exposes-api-keys ↗