Opto 22 groov View Privilege Escalation Vulnerability Exposing API Keys

A privilege escalation vulnerability has been identified in the Opto 22 groov View API, specifically in the users endpoint. This endpoint, which requires an Editor role to access, returns a list of all users along with their associated metadata, including API keys. Notably, the API keys of Administrators are also exposed. The vulnerability is present in groov View Server for Windows versions 3.3a through 4.5d, as well as GRV-EPIC-PR1 and GRV-EPIC-PR2 Firmwares prior to 4.0.3.

Impact

Exploitation of this vulnerability could lead to unauthorized access to API keys, allowing for credential and key exposure, and potential privilege escalation.

Remediation

Opto 22 has released a patch for this vulnerability. Users are advised to upgrade to groov View Server for Windows Version 4.5e and GRV-EPIC Firmware Version 4.0.3. Additional information can be found on the Opto 22 website.