Description

The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T22:16:29.087Z",
  "pubdate": "2026-08-26T22:16:29.087Z",
  "executiveSummary": "The super-diamond-server configuration distribution service, listening on TCP port 8283, suffers from a critical authentication bypass vulnerability. Versions 1.3.3 and earlier fail to implement any access control mechanisms for client requests, allowing unauthorized entities to retrieve sensitive configuration data.\nThe vulnerability allows remote, unauthenticated attackers to query the service and extract the full configuration set for any managed project. Because these configurations often contain high-entropy credentials such as database passwords, API keys, service tokens, and internal connection strings, successful exploitation leads to a complete compromise of the underlying infrastructure and services reliant on these configurations.\nThe lack of authentication represents a severe security misconfiguration, effectively exposing internal service secrets to any network-adjacent actor. No specialized privileges or user interaction are required to conduct this attack, as the service processes requests immediately upon receipt. Organizations utilizing super-diamond-server should treat this as a high-risk exposure requiring immediate remediation.",
  "technicalDetails": "The vulnerability resides within the Netty-based configuration distribution service of super-diamond-server. The implementation fails to enforce an authentication handshake or session validation protocol before processing configuration retrieval requests. Consequently, the service exposes an insecure API endpoint that responds to arbitrary TCP requests with serialized or raw configuration payloads.\nThe root cause is a fundamental design flaw where the service assumes a trusted network environment, omitting necessary identity and access management (IAM) controls. The service listens by default on port 8283 and lacks any internal logic to differentiate between authorized administrative components and malicious external actors.\nThe exploitation flow is straightforward: an attacker establishes a TCP connection to the target server on port 8283. Without the requirement for credentials, certificates, or tokens, the attacker sends a standard request designed to trigger the configuration dump function. The vulnerable service, lacking authentication checks, parses the request and returns the requested configuration objects directly over the socket. This allows an attacker to iterate through project identifiers to scrape the entirety of the configuration repository.\nSince the configuration data often includes environment-specific secrets such as database credentials, SMTP settings, and third-party API keys, the post-exploitation impact is catastrophic. Attackers can leverage these recovered secrets to perform lateral movement, gain unauthorized access to backend databases, intercept sensitive communications, or pivot into other internal network segments.\nThis vulnerability is classified as an improper authentication or authentication bypass flaw. Given that the service is built on the Netty framework, the communication handling happens asynchronously, but the absence of a security filter or authentication interceptor ensures that the payload is serviced regardless of the connection source. The exposure is total for any network segment that has routing capabilities to the host running super-diamond-server on port 8283, meaning the service is inherently insecure in any non-isolated network environment."
}