Hard-Coded Credentials in DataBuff ai-apm-web

Executive Summary

This vulnerability is a hard-coded default credentials issue in DataBuff ai-apm-web through version 0.1.10. It allows unauthenticated attackers to gain administrator access using the built-in admin account with the password 'Databuff@123'. Attackers can send a POST request to /webapi/api/v1/auth/login with these credentials to obtain an administrator token and access all protected /webapi routes.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access attempts to /webapi/api/v1/auth/login with the default credentials admin:Databuff@123. Inspect network logs for POST requests to this endpoint. Verify if JWT tokens are generated using the hardcoded secret 'change-me-in-production'.

Useful 0 Not Useful 0

Impact Analysis

Attackers can gain full administrative access to the DataBuff system without authentication. This allows them to read and modify sensitive configurations, access AI chat sessions and workspace files, and execute read-only SQL queries against the observability store. The impact includes unauthorized data access, system manipulation, and potential data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The breach of admin credentials could lead to unauthorized data exposure, non-compliance penalties, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately rotate the default admin password and JWT secret. Update to the latest version of DataBuff ai-apm-web beyond 0.1.10. Block external access to /webapi/api/v1/auth/login if not required. Monitor for suspicious admin token generation.

Useful 0 Not Useful 0