제출 #1041008: lanyulei ferry <= 1.0.0 JWT Empty Secret Authentication Bypass
| 제목 | lanyulei ferry <= 1.0.0 JWT Empty Secret Authentication Bypass |
|---|---|
| 설명 | ferry 1.0.0 and earlier validate session tokens with a JWT signing key that is either empty or left at the hard-coded factory default. An unauthenticated attacker who knows the token layout can mint a token carrying "rolekey": "admin" and an arbitrary future exp; the server accepts it as a fully privileged session. The impact is amplified by the authorization design: the Casbin enforcer takes its subject directly from the rolekey claim inside the token and never re-reads the user's role from the database. Forging that one claim is therefore equivalent to holding the administrator role. Because the same empty/default key also works across independent deployments of the product, this is a product-level defect rather than a single-site misconfiguration, and it can be mass-exploited via a search-engine fingerprint |
| 원천 | ⚠️ https:/ |
| 사용자 | liumiya (UID 102169) |
| 제출 | 2026. 10. 18. AM 10:20 (25 날 ago) |
| 모더레이션 | 2026. 11. 12. PM 06:34 (25 days later) |
| 상태 | 수락 |
| VulDB 항목 | 436447 [lanyulei ferry 1.0.0/1.0.0-beta.1 JWT Validation middleware/auth.go 약한 인증] |
| 포인트들 | 20 |