| tiêu đề | orionsec Orion-ops (server component) <= master commit 5925824997a3109651bbde07460958a7be249ed1 Improper Access Control / Information Disclosure (exposed machin |
|---|
| Mô tả | Orion-ops uses the MachineKeyController to manage SSH key material that is later injected into deployment workflows. The controller exposes listing and detail endpoints without narrowing the caller’s role. In the download path, FileDownloadServiceImpl trusts the provided id and never checks that the requesting user actually owns, uploaded, or has any relationship with that key. The download tokens are therefore unscoped and reusable by any session. This behavior is inconsistent with the intent of storing sensitive SSH credentials on the server side and results in total disclosure of the stored secrets. |
|---|
| Nguồn | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md |
|---|
| Người dùng | sh7err03 (UID 92418) |
|---|
| Đệ trình | 10/11/2025 12:12 (cách đây 9 các tháng) |
|---|
| Kiểm duyệt | 30/11/2025 15:25 (20 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 333817 [orionsec orion-ops đến 5925824997a3109651bbde07460958a7be249ed1 API MachineKeyController.java MachineKeyController nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|