Executive brief
Orion-ops is a server-based infrastructure operations and key management system used to store and manage SSH private keys for administrative access to servers. A flaw in the API authorization logic allows any authenticated user to bypass access controls and download all stored SSH private keys, potentially granting attackers complete access to managed infrastructure and sensitive systems.
Technical details
The vulnerability is an improper authorization flaw (CWE-285) in the MachineKeyController REST API endpoints. The affected endpoints (POST /orion/api/machine-key/list, /machine-key/detail, and /file-download/token) lack role-based access control (@RequireRole) enforcement, allowing any logged-in user to enumerate SSH key IDs and retrieve internal file paths. The FileDownloadServiceImpl#getDownloadToken function issues download tokens without verifying ownership—storing only the requester's user ID in Redis without revalidation—enabling low-privileged accounts to download SSH private keys uploaded by administrators. Attack requires only a valid login session and network access to the API; no additional authentication is needed once authenticated. The exploit is public and no official patch has been released.
Affected products
- OrionSec Orion-ops up to commit 5925824997a3109651bbde07460958a7be249ed1
Timeline
- 2025-12-01: disclosed: Vulnerability disclosed publicly
- 2025-12-01: exploited: Exploit code released publicly