Description
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| semaphoreui | semaphore | ≤ 2.19.12 | — |
References
- GitHub Issue #4150 issue-tracking exploit
- GetMustCanMiddleware at v2.19.12 technical-description
- projectUserAPI environment routes at v2.19.12 technical-description
- https://github.com/semaphoreui/semaphore product
- VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests third-party-advisory