GHSA-95mq-xwj4-r47p

Summary

An unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token from --security "token=...".

This does not break token validation logic directly; instead, it discloses the credential and enables unauthorized admin-level access by reusing the leaked token in X-Dgraph-AuthToken.

Details

The behavior occurs entirely within core Alpha HTTP routing and does not require any external proxy, plugin, or non-core integration.

The core issue is not that admin token protection is absent, but that the protected secret is exposed in cleartext through an unauthenticated core debug endpoint.

Relevant code paths:

• dgraph/cmd/alpha/run.go:17 imports net/http/pprof, which registers /debug/pprof/* handlers on the default mux.
• dgraph/cmd/alpha/run.go:533 uses http.Handle("/", audit.AuditRequestHttp(baseMux)), so default-mux handlers remain reachable.
• dgraph/cmd/alpha/admin.go:52 enforces admin token checks in adminAuthHandler for admin endpoints.
• dgraph/cmd/alpha/admin.go:74 shows /admin/config/cache_mb behind adminAuthHandler.

Credential-exposure chain:

1. /debug/pprof/cmdline is reachable without authentication.
2. Its output includes the configured admin token from process arguments.
3. The disclosed token is accepted by adminAuthHandler when sent as X-Dgraph-AuthToken.
4. An attacker gains unauthorized access to admin-only functionality.

Observed local evidence (safe validation):

• Request: GET /admin/config/cache_mb without token
  • Status: 200 (request rejected at application layer)
  • Body contains error: Invalid X-Dgraph-AuthToken
  • The endpoint returns HTTP 200 but indicates authentication failure in the response body.
• Request: GET /debug/pprof/cmdline without token
  • Status: 200
  • Body excerpt includes: --security=token=TopSecretToken123;
• Request: GET /admin/config/cache_mb with X-Dgraph-AuthToken: TopSecretToken123
  • Status: 200...