CVE-2025-13807 Details
Description
A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Orionsec Orion-Ops server component versions up to master commit 5925824997a3109651bbde07460958a7be249ed1. The issue is located in the MachineKeyController of the API component, specifically within the orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java' file. This vulnerability allows improper authorization, enabling any logged-in user to access sensitive information. The affected API endpoints do not properly validate user roles, allowing unauthorized access to SSH key data. The vulnerability can be exploited remotely, and a public exploit is available.
It is recommended to restrict access to all machine key management APIs to administrator roles only. Additionally, when issuing download tokens, verify that the requesting user is authorized to access the specific key and enforce this check again when executing the download. Consider encrypting stored keys with a hardware-backed secret to prevent the API layer from returning raw key material to clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md#proof-of-concept | CISA-ADP | Exploit |
| https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md | [email protected] | ExploitThird Party Advisory |
| https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md#proof-of-concept | [email protected] | Exploit |
| https://vuldb.com/?ctiid.333817 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.333817 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.692066 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| orionsec orion-ops | <= 2025-08-01 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Dec 4, 2025 | Initial Analysis | [email protected] |
| Dec 1, 2025 | CVE Modified | CISA-ADP |
| Dec 1, 2025 | New CVE Received | [email protected] |