Databuff
Monthly
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.