| शीर्षक | aiyiyi121 SxDevOps 1.1 Use of Hard-coded Cryptographic Key |
|---|
| विवरण | SxDevOps hardcodes a Django SECRET_KEY fallback value in sxdevops/settings.py. The key uses the django-insecure- prefix which Django itself flags as insecure, yet it is used as a fallback when the SECRET_KEY environment variable is not set (the default).
Vulnerable code in backend/sxdevops/settings.py lines 341-344:
SECRET_KEY = os.getenv("SECRET_KEY") or "django-insecure-ag#xxnjm^46$=ye()w$yma8r8oy3&wfq!8_=bm!kwe0e((&y3-"
With a known SECRET_KEY, attackers can:
1. Forge signed Django session cookies to assume the identity of any user including superadmin
2. Bypass CSRF protection by generating valid CSRF tokens
3. Generate valid password reset tokens for any user account
Impact: Authentication bypass via session forgery, CSRF protection bypass, and password reset abuse — enabling full account takeover without needing valid credentials. |
|---|
| स्रोत | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| उपयोगकर्ता | _lxf (UID 63911) |
|---|
| सबमिशन | 24/08/2026 04:51 AM (27 दिन पहले) |
|---|
| संयम | 19/09/2026 12:15 PM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407929 [aiyiyi121 SxDevOps 1.0/1.1 Settings settings.py कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|