Problem
The JVM Info screen in the maintenance portlet (GET /api/v1/jvm) obfuscates sensitive values in the System Properties and Environment Variables sections via JVMInfoResource.obfuscateIfNeeded() (masks values whose key matches passw|pass|passwd|secret|key|token, plus the configurable OBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLES pattern).
The configOverrides section does not: getDBOverrides() copies SystemTable.all() straight into the response, so any secret stored as a system-table config override (API keys, tokens, passwords set via the UI/API) is rendered in plaintext to anyone with maintenance-portlet access.
Fix
Apply the same obfuscateIfNeeded(key, value) rules to the config-overrides map — one line in JVMInfoResource.getDBOverrides().
Security note
Read access already requires a backend user with the maintenance portlet, so exposure is limited to authenticated admins — but the whole point of the existing obfuscation is that even admins shouldn't see raw secrets on a screen that gets screenshotted into support tickets.
Problem
The JVM Info screen in the maintenance portlet (
GET /api/v1/jvm) obfuscates sensitive values in the System Properties and Environment Variables sections viaJVMInfoResource.obfuscateIfNeeded()(masks values whose key matchespassw|pass|passwd|secret|key|token, plus the configurableOBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLESpattern).The configOverrides section does not:
getDBOverrides()copiesSystemTable.all()straight into the response, so any secret stored as a system-table config override (API keys, tokens, passwords set via the UI/API) is rendered in plaintext to anyone with maintenance-portlet access.Fix
Apply the same
obfuscateIfNeeded(key, value)rules to the config-overrides map — one line inJVMInfoResource.getDBOverrides().Security note
Read access already requires a backend user with the maintenance portlet, so exposure is limited to authenticated admins — but the whole point of the existing obfuscation is that even admins shouldn't see raw secrets on a screen that gets screenshotted into support tickets.