Unauthenticated Access to Keploy Agent Control Plane

Keploy versions 3.1.0 through 3.6.25 include an insecure configuration where the agent control-plane HTTP server binds to all network interfaces (0.0.0.0) without requiring authentication. This exposure allows remote, unauthenticated attackers to interact with sensitive API endpoints. By accessing the /agent/pcap/keylog endpoint, an attacker can retrieve NSS keylog lines, which are sufficient to decrypt intercepted TLS traffic. Additionally, the vulnerability allows unauthorized access to management endpoints, specifically /agent/stop and /agent/storemocks, which can be leveraged to disrupt, terminate, or manipulate data recording sessions. This poses a significant risk to development and testing environments where Keploy is used to capture application traffic. Defenders should ensure Keploy instances are not exposed to untrusted networks and update to a patched version immediately.

Impact

Successful exploitation allows for the decryption of sensitive TLS traffic captured during session recording and the unauthorized control or corruption of testing data streams. This vulnerability impacts development, staging, and testing environments where Keploy is deployed, potentially compromising internal credentials, API keys, or proprietary data transmitted within the recorded sessions.

Recommendation

• Upgrade Keploy to version 3.6.26 or later to enforce authentication on control-plane endpoints.
• Implement network-level access control (firewall or security groups) to restrict access to the Keploy agent control-plane port to authorized management hosts only.
• Audit existing recording sessions for signs of unauthorized manipulation or access to the /agent/pcap/keylog endpoint.