CyberRota Analysis
AI-GeneratedApollo ConfigService versions prior to 2.5.2 are vulnerable to unauthorized access to raw configuration data due to improper authentication handling, which allows attackers to bypass signature verification. This flaw can lead to exposure of sensitive configuration information, posing a significant risk to organizations relying on Apollo for microservice management. Users of affected versions should prioritize upgrading to 2.5.2 to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.