CyberRota Analysis
AI-GeneratedVersions 3.1.0 through 3.6.25 of keploy are vulnerable due to the agent control-plane HTTP server being bound to all interfaces without authentication, allowing unauthorized access to sensitive endpoints. This exposure enables attackers to retrieve TLS session keys and traffic data, potentially leading to the decryption of recorded TLS traffic and manipulation of recording sessions. Organizations using affected versions should prioritize remediation to protect sensitive data and maintain the integrity of their network communications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.