Phase Console Missing Authorization Exposes Secret History

Executive Summary

This vulnerability is a missing authorization flaw in Phase Console versions up to 2.77.3. It allows organization members without Secrets read permission to access secret history through a GraphQL query called secretHistory. Attackers with an environment key can exploit this by providing a known secret identifier to retrieve encrypted secret events and decrypt values using the wrapped environment key.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Phase Console version is 2.77.3 or earlier. Review GraphQL query logs for unauthorized secretHistory requests. Look for users with environment key access but lacking Secrets:read permission attempting to query secret history.

Useful 0 Not Useful 0

Impact Analysis

An attacker who is an authenticated organization member with environment access but lacks Secrets read permission could exploit this to view sensitive secret history. This includes secret values, comments, paths, tags, timestamps, and metadata. The attacker needs knowledge of the target secret ID and the environment key to decrypt exposed ciphertext.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of secret history may result in data breaches, non-compliance with data protection regulations, and potential legal penalties due to unauthorized access to protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Phase Console to a version beyond 2.77.3 where the vulnerability is patched. Review and enforce strict permission checks for secretHistory queries. Ensure only authorized users with Secrets:read permission can access secret history.

Useful 0 Not Useful 0