CyberRota Analysis
AI-GeneratedDevtron versions up to 2.2.0 are vulnerable due to a lack of authorization checks on the GET /orchestrator/api-token/webhook endpoint, enabling any authenticated user to access sensitive admin API tokens. This flaw allows attackers to obtain plaintext super-admin JWT tokens, granting them full control over the platform. Organizations using affected versions should prioritize patching this vulnerability to prevent potential exploitation by malicious insiders or compromised accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.