GHSA-8wpc-j9q9-j5m2 Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key LeakageSummaryThis vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the `/orchestrator/attributes?key=apiTokenSecret` endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster.**CWE Classification**: CWE-862 (Missing Authorization)DetailsVulnerability MechanismDevtron uses a JWT-based API Token mechanism for authentication. All API Tokens are signed using HMAC-SHA256 with the `apiTokenSecret` stored in the database. This key is exposed through the Attributes API, but the authorization check code for this API has been commented out, allowing any authenticated user to read it.Source Code Analysis**Vulnerability Location**: `api/restHandler/AttributesRestHandlder.go:173-195`**Key Usage**: `pkg/apiToken/ApiTokenSecretService.go:54-88`This key is used to sign and verify all Devtron API Tokens and is the core credential of the control plane.PoC (Proof of Concept)Environment SetupPrerequisitesKubernetes cluster (v1.22+)kubectl configuredHelm 3.xPython 3.x with PyJWT libraryStep 1: Install DevtronStep 2: Access Devtron DashboardAccess http://127.0.0.1:8000 and login with admin account.Exploitation StepsStep 1: Obtain User TokenLogin as a regular user and obtain token:**Actual Output Example**:Step 2: Exploit Vulnerability to Retrieve apiTokenSecretUse the obtained token to access the unauthorized Attributes API:**Actual Output Example**:Step 3: Forge Admin JWT TokenForge admin token using the leaked key:**Actual Output Example**:Step 4: Test Forged Token with Admin APIsUse the forged token to access admin APIs:**Actual Output Example**:Expected ResultIf the vulnerability exists, it should be able to:Successfully obtain `apiTokenSecret` using any authenticated user's tokenSuccessfully forge JWT tokens using the leaked keySuccessfully access admin-only APIs using the forged tokenRetrieve sensitive information such as user lists, cluster configurations, etc.ImpactSecurity Impact**Confidentiality**: Severe impact. Attackers can:Obtain the global API Token signing keyRead all user information and permission configurationsAccess Kubernetes cluster configurations and credentialsRead sensitive application configurations and Secrets**Integrity**: Severe impact. Attackers can:Forge API Tokens for arbitrary user identitiesModify application configurations and deploymentsCreate or delete CI/CD pipelinesModify user permissions and roles**Availability**: High impact. Attackers can:Delete critical applications and configurationsDisrupt CI/CD processesModify cluster configurations causing service interruptionsBusiness Impact**Complete Control of Devtron Platform**: Attackers gain privileges equivalent to super administrators**Lateral Movement to Kubernetes Cluster**: Cluster credentials obtained through Devtron can directly control the underlying Kubernetes**Supply Chain Attacks**: Can modify CI/CD pipelines to inject malicious code**Data Breach**: Can access all application configurations and Secrets**Cloud Environment Penetration**: In cloud environments, can further obtain IAM credentialsAttack Scenarios**Scenario 1: Insider Threat**Low-privileged developer exploits this vulnerability to escalate privilegesGains full access to production environmentSteals sensitive data or plants backdoors**Scenario 2: Supply Chain Attack**Attacker obtains low-privileged account through social engineeringExploits vulnerability to gain admin privilegesModifies CI/CD pipelines to inject malicious codeAffects all applications using the pipeline**Scenario 3: Lateral Movement**Attacker has already compromised a low-privileged accountExploits this vulnerability to gain Kubernetes cluster accessDeploys cryptocurrency miners or other malicious payloads in the clusterSeverity**CVSS v3.1 Score**: 9.8 (Critical)**CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H**Score Breakdown**:**Attack Vector (AV:N)**: Network accessible, exploited via HTTP API**Attack Complexity (AC:L)**: Low complexity, requires only one HTTP request**Privileges Required (PR:L)**: Requires low privileges (any authenticated user)**User Interaction (UI:N)**: No user interaction required**Scope (S:C)**: Scope changed, can affect resources beyond Devtron (Kubernetes cluster)**Confidentiality (C:H)**: High impact, can read all sensitive information**Integrity (I:H)**: High impact, can modify all configurations and data**Availability (A:H)**: High impact, can delete resources and disrupt services**Severity Level**: CriticalAffected VersionsDevtron: All versions (as of 2026-01-26 verification)Specifically affected code files:`api/restHandler/AttributesRestHandlder.go``pkg/apiToken/ApiTokenSecretService.go`WorkaroundsBefore an official patch is released, the following temporary measures can be taken:Option 1: Network-Level RestrictionsOption 2: Rotate API Token SecretOption 3: Add API Gateway FilteringDeploy an API Gateway in front of Devtron to filter sensitive requests to `/orchestrator/attributes`.Credits@b0b0haha (603571786@qq.com)
@lixingquzhi(mayedoushidalao@163.com)
CVSS v4.0 score: 8.7