Trtnx/dbgpt-datasource-credential-disclosure-poc

DB-GPT v0.8.0 — Unauthenticated datasource credential disclosure (plaintext password leak) — huntr PoC

Private/gated proof-of-concept accompanying a huntr vulnerability report. Access is granted only to the huntr triage bot.

Target: eosphoros-ai/DB-GPT @ v0.8.0 (commit a3f21350, latest release).

The datasource API ships stored DB credentials to the client in cleartext. RDBMSDatasourceParameters tags its password field with metadata={"tags":"privacy"} and str(param) honours it (masks the secret) — but BaseParameters.to_dict() (asdict) ignores the tag, and DatasourceService._to_query_response returns param.to_dict() as DatasourceQueryResponse.params. The privacy control masks in one path and leaks the plaintext password in the serializer path — a genuinely broken defense, not merely "missing auth".

Contents

• README.md — this file.
• REPORT.md / POC.md — the vulnerability report and walkthrough (added separately).
• poc/fire_031.py — self-contained deterministic PoC (differential oracle: str() masks vs to_dict() leaks, on the same secret). Run network-isolated:

  unshare --user --map-root-user --net python3 poc/fire_031.py
  

• poc/vendor/ — the four real v0.8.0 source files the PoC loads/executes, byte-identical to the released PyPI wheel dbgpt==0.8.0 — sha256 in poc/PROVENANCE.txt:
  • parameter_utils.py (BaseParameters.__str__ / .to_dict / masking),
  • manager.py (RegisterParameters / polymorphic metaclass),
  • parameter.py (BaseDatasourceParameters.from_persisted_state),
  • base.py (the RDBMSDatasourceParameters class with the password privacy tag).
• poc/sandbox_031.log — a recorded run (differential oracle + server-sink reproduction, all PASS).

Harmless in-memory dataclass ops only; no network egress; the target repository is never built or installed.