Data Platform Open
Monthly
Stored datasource passwords in data-platform-open (through commit efeacd3) can be recovered in plaintext by any authenticated, low-privileged workspace user, because the service encrypts those passwords with a hardcoded AES key that is published in the project's own source repository. An attacker who reaches the datasource detail API - for example by abusing a cross-workspace IDOR to read datasources belonging to other tenants - can pull the ciphertext and decrypt it offline without any key-cracking effort, exposing the underlying database credentials. The issue is authentication-gated rather than remote-unauthenticated, is limited to confidentiality impact, and no public exploit code has been identified at time of analysis.
Authenticated workspace members can exploit an insecure direct object reference in Shaiwz data-platform-open (through commit efeacd3) to read, modify, or delete datasources belonging to other workspaces by supplying sequential numeric IDs. The flaw exposes JDBC credentials and database schemas via endpoints /datasource/detail, /listSchemaTable, /tableDetail, /update, and /delete, with no per-workspace authorization check. No public exploit code identified; exploitation requires a valid workspace-member account (PR:L) and no user interaction, and the impact is assessed as a moderately serious authorization flaw rather than an emergency-tier vulnerability.
Stored datasource passwords in data-platform-open (through commit efeacd3) can be recovered in plaintext by any authenticated, low-privileged workspace user, because the service encrypts those passwords with a hardcoded AES key that is published in the project's own source repository. An attacker who reaches the datasource detail API - for example by abusing a cross-workspace IDOR to read datasources belonging to other tenants - can pull the ciphertext and decrypt it offline without any key-cracking effort, exposing the underlying database credentials. The issue is authentication-gated rather than remote-unauthenticated, is limited to confidentiality impact, and no public exploit code has been identified at time of analysis.
Authenticated workspace members can exploit an insecure direct object reference in Shaiwz data-platform-open (through commit efeacd3) to read, modify, or delete datasources belonging to other workspaces by supplying sequential numeric IDs. The flaw exposes JDBC credentials and database schemas via endpoints /datasource/detail, /listSchemaTable, /tableDetail, /update, and /delete, with no per-workspace authorization check. No public exploit code identified; exploitation requires a valid workspace-member account (PR:L) and no user interaction, and the impact is assessed as a moderately serious authorization flaw rather than an emergency-tier vulnerability.