Description
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
shaiwz data-platform-open
Default version status: unaffected
0 to ≤ efeacd35e8450b7a084fa2134d292cd058cf605baffected
pkg:github/shaiwz/data-platform-openReferences
- https://hackmd.io/@hieuPenguinnn/data-platform-open-datasource-cross-workspace-idor-and-hardcoded-aes-key ↗
- https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-web/src/main/java/cn/dataplatform/open/web/service/impl/AesPasswordEncAndDecServiceImpl.java#L21-L25 ↗
- https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-common/src/main/resources/application-common.yml#L104-L106 ↗
- https://www.vulncheck.com/advisories/data-platform-open-through-commit-efeacd3-hardcoded-aes-key-for-datasource-passwords ↗