Description

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-13T11:16:59.827Z",
  "pubdate": "2026-09-13T11:16:59.827Z",
  "executiveSummary": "Dromara orion-visor versions up to 2.5.7 contain a critical security vulnerability involving the use of a hard-coded cryptographic key within the host key management module. This flaw allows unauthorized entities to potentially decrypt sensitive information or manipulate encrypted data stored within the system.\nThe vulnerability is classified as an improper implementation of cryptographic protocols, specifically CWE-321: Use of Hard-coded Cryptographic Key. The vulnerability resides in the HostKeyServiceImpl.encryptKey function, which is responsible for securing sensitive host credentials. The presence of a static, hard-coded key within the source code base undermines the confidentiality and integrity of the application's credential storage mechanism.\nBecause the key is baked into the application logic, it is accessible to any party with access to the source code or a compiled binary, facilitating reverse engineering. An attacker can perform remote exploitation to decrypt stored host keys, potentially leading to unauthorized access to downstream systems managed by orion-visor. Given that the exploit has been disclosed publicly and the project maintainers have not yet provided a response or a patch, the risk level is high for all deployments currently running versions 2.5.7 and earlier.",
  "technicalDetails": "The vulnerability originates in the orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java file, specifically within the encryptKey method. The implementation utilizes a static cryptographic key embedded directly into the application code to perform encryption operations on sensitive host private keys or authentication tokens.\nThe exploitation flow begins with the attacker obtaining access to the application's compiled artifacts or source code. Through static analysis or reverse engineering of the Java bytecode, an attacker can identify the specific key used in the encryptKey method. Since this key is uniform across all installations, an attacker does not need per-instance secret knowledge to compromise the encrypted data.\nOnce the key is extracted, the attacker can target the application's persistence layer where encrypted host keys are stored. By accessing the database or the configuration files containing these ciphertext blobs, the attacker applies the retrieved key to perform decryption. This bypasses the intended security controls of the asset module, enabling the attacker to recover plaintext credentials.\nThe attack is remotely exploitable if the attacker has access to the application's database or the underlying data store, or if they can leverage other vulnerabilities (such as SQL injection or unauthorized file access) to retrieve the encrypted data. The impact is a full compromise of managed host assets, as the attacker can impersonate authorized users or the system itself to gain access to target infrastructure. Because the encryption logic is centralized within the HostKeyServiceImpl, all assets protected by this service are inherently vulnerable.\nThis issue is exacerbated by the absence of a dynamic key management strategy or a hardware security module (HSM) integration, which would traditionally prevent static key exposure. As the project has not responded to vulnerability reports, there is no official hotfix available, leaving systems exposed to automated exploitation using the publicly disclosed techniques."
}