Description
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Phase | Phase Console | ≤ 2.77.3 | — |
References
- Researcher Advisory third-party-advisory
- Vulnerable Code: resolve_secret_history (v2.77.3) technical-description
- resolve_secrets permission checks (v2.77.3) technical-description
- user_can_access_environment (v2.77.3) technical-description
- https://github.com/phasehq/console product
- VulnCheck Advisory: Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query third-party-advisory