An unauthenticated remote attacker can bypass authentication in Dromara orion-visor by leveraging a publicly known hard-coded default token, leading to potential unauthorized system manipulation.

The application utilizes a hard-coded default token, pmqeHOyZaumHm0Wt, within the ExposeApiAspect.java file for internal API authentication. Because this token is publicly visible in the source code, an unauthenticated attacker can supply it in the header to bypass security controls on all endpoints annotated with @ExposeApi.

Successful exploitation allows an unauthorized remote actor to interact with sensitive API endpoints, including those that manage host agent states and monitor host specifications. This can lead to the injection of malicious monitoring data, disruption of host management, and loss of system integrity. While the provided CVSS score is 7.3, the ability to perform unauthenticated remote actions against host agents poses a significant risk to operational stability and system trust.

Immediate Action: Manually override the default token by setting the API_EXPOSE_TOKEN environment variable to a strong, unique, and randomly generated string. Ensure that the default configuration in application-prod.yaml is never used in production environments.

Proactive Monitoring: Review access logs for any requests to the /orion-visor/api/ endpoint that utilize the default token or show anomalous behavior from unauthorized IP addresses. Monitor host agent connectivity logs for unexpected state changes or heartbeat irregularities.

Compensating Controls: Implement network-level restrictions, such as IP allowlisting, to restrict access to the /orion-visor/api/ path exclusively to trusted internal management servers. Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing the known default token.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security research write-up.

The presence of a hard-coded credential in a security-sensitive component constitutes a critical configuration flaw. Administrators must prioritize overriding the default token immediately, as the credential is publicly known and facilitates unauthorized access to core system management functions. Continued operation using the default configuration is strongly discouraged.