Attack Chain

1. Attacker performs reconnaissance to identify DataBuff ai-apm-web deployments via public-facing services.
2. Attacker interacts with the target /webapi routes to confirm application presence.
3. Attacker retrieves the publicly available source code or identifies the hardcoded 'dev-secret' from the JwtTokenService implementation.
4. Attacker constructs a malicious JWT payload containing 'admin' claims and an extended expiration date.
5. Attacker signs the malicious JWT using the identified 'dev-secret' HMAC key.
6. Attacker submits the forged JWT in the 'Authorization' header of HTTP requests directed at protected /webapi endpoints.
7. DataBuff server validates the forged signature, incorrectly authenticating the request.
8. Attacker gains full administrative control over the application, including the ability to execute arbitrary queries against the Doris SQL API.

Impact

Successful exploitation results in full administrative access to the ai-apm-web application. Impacted organizations face risks of data exfiltration from the underlying Doris SQL database, unauthorized modification of application settings, and potential secondary exploitation of the host environment. This vulnerability affects all DataBuff ai-apm-web users running version 0.1.10 or earlier.

Recommendation

• Patch ai-apm-web to a version containing a remediated, non-hardcoded authentication secret immediately.
• Audit logs for suspicious administrative activity originating from anomalous IP addresses or unexpected sessions using forged JWT signatures.
• Restrict network access to the /webapi routes to authorized subnets to mitigate exposure to unauthenticated external actors.
• Implement centralized monitoring for the Doris SQL query API to detect and block unauthorized query patterns.