Description

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T10:16:56.117Z",
  "pubdate": "2026-09-13T10:16:56.117Z",
  "executiveSummary": "A critical security vulnerability has been identified in dromara orion-visor versions up to 2.5.7, characterized by the presence of hard-coded credentials.\nThis vulnerability is classified as a failure to securely manage sensitive authentication data, directly exposing the application to unauthorized access.\nThe flaw resides within the ExposeApiAspect.beforeExposeApi function in the ExposeApiAspect.java file, which facilitates remote exploitation by an unauthenticated attacker.\nBecause the credentials are embedded directly within the source code, they are immutable by standard administrative processes and provide a static target for malicious actors.\nThe risk implication is severe, as successful exploitation permits unauthorized users to bypass authentication mechanisms, potentially leading to full system compromise, unauthorized data access, or administrative control over the affected orion-visor instance.\nPublic availability of exploit code increases the likelihood of opportunistic attacks targeting this specific vulnerability.\nOrganizations utilizing affected versions are at high risk, as no official patch has been provided by the project maintainers following notification.",
  "technicalDetails": "The vulnerability originates in the ExposeApiAspect.java file, specifically within the logic defined in the ExposeApiAspect.beforeExposeApi function. This function is responsible for intercepting API calls and managing access control or audit logic. Analysis reveals that the implementation incorporates static, hard-coded authentication credentials used to facilitate access or administrative actions during the API exposition process.\nThe root cause is the inclusion of sensitive, plaintext, or statically defined cryptographic/authentication secrets within the application source code rather than employing secure secret management practices, such as environment variables, vault services, or dynamically generated tokens.\nExploitation is achieved by remotely invoking the affected API endpoints that trigger the ExposeApiAspect interceptor. Because the logic within beforeExposeApi relies on these hard-coded secrets to validate or authorize requests, an attacker who possesses knowledge of these credentials—often extracted through static analysis of the binary or source code—can craft malicious requests that bypass standard authentication protocols.\nThe attack flow follows a predictable pattern: first, the attacker identifies the reachable API endpoints handled by the vulnerable aspect. Second, the attacker utilizes the discovered hard-coded credentials to authenticate their session or elevate privileges during the execution of the beforeExposeApi method. Since the method executes prior to the main API logic, the attacker can effectively masquerade as an authorized entity or bypass secondary security checks entirely.\nThis vulnerability is particularly dangerous because the exposure is network-accessible. An attacker does not require local system access or pre-existing valid credentials to initiate the exploit. The technical impact post-exploitation allows for unauthorized API execution, which may lead to arbitrary data retrieval, unauthorized modification of application settings, or further exploitation of the underlying host environment.\nGiven that the exploit is publicly available, the barrier to entry for attackers is minimal. Systems running orion-visor 2.5.7 and earlier are inherently vulnerable due to the lack of dynamic credential rotation and the static nature of the secret embedded in the codebase. The absence of a project response or patch exacerbates the risk, as there is currently no vendor-provided remediation mechanism to remove or replace the vulnerable code segment."
}