Horizon Alert
Summary of the vulnerability and why it matters
The sealed-env secret management library, in its enterprise mode, incorrectly embeds a critical secret directly into tokens. This means anyone able to access these tokens, even from logs or environment dumps, can easily expose the secret in plaintext. This could lead to unauthorized access or compromise of systems relying on these secrets.
- Sensitive secrets exposed in tokens.
- Accessible from logs and environment data.
- Impacts Node.js and Java/Spring Boot.
Attack Path
How an attacker could exploit the issue
An attacker could steal the TOTP secret from `sealed-env` if they can access minted unseal tokens. These tokens are created without encryption, and the TOTP secret is directly embedded and base64-encoded in the token's payload. Anyone observing these tokens, such as in CI/CD logs or container environment dumps, can easily extract the secret.
- Observe minted tokens.
- Decode base64 payload.
- Gain TOTP secret.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in sealed-env's enterprise mode, where TOTP secrets were embedded in JWS payloads, is unlikely to be weaponized by external attackers. The exposure vector is limited to internal infrastructure, such as CI build logs or container environments, rather than internet-facing services. This significantly reduces the attack surface and the likelihood of widespread exploitation by remote threat actors.
- Only internal access needed for token observation.
- No public exploit code observed.
- Vulnerability fixed in a recent version.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediately updating sealed-env to 0.1.0-alpha.4 if you are using it in enterprise mode to prevent sensitive TOTP secrets from being exposed in JWS payloads. If an immediate update is not feasible, review all logs, CI/CD pipelines, and container environments for any exposed tokens that could have revealed secrets.
- Update sealed-env to version 0.1.0-alpha.4.
- Inspect logs and environment dumps for exposed TOTP secrets.
- Implement stricter access controls for token generation and storage.
