Apollo vulnerabilities

Apollo ConfigService before version 2.5.2 may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled. The issue stems from incorrect parsing of the request path /configfiles/raw/{appId}/{clusterName}/{namespace}, where the application ID is read as 'raw' instead of the actual value from the URL, potentially bypassing signature verification for the target application.

Apollo ConfigService prior to version 2.5.2 may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. This occurs because ConfigService accepts non-canonical appId variants (e.g., accent or trailing-space variants) during authentication, which are later resolved to the protected app on /configs and /configfiles endpoints.

In Apollo Portal prior to version 2.5.0, a vulnerability exists due to missing permission checks for applications and namespaces when fetching a release by its ID. An authenticated low-privileged user can read configuration data from other applications if they know or guess a valid releaseId, bypassing the UserPermissionValidator.shouldHideConfigToCurrentUser(...) mechanism.