Description
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pig-mesh | pig | < 4.1.2 | 4.1.2 |
References
- GitHub Issue #1298 issue-tracking
- https://github.com/pig-mesh/pig product
- https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82 technical-description
- https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3 patch
- pig v4.1.2 Release Notes release-notes
- VulnCheck Advisory: Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client third-party-advisory