| 제목 | liufee feehi cms 2.1.1 配置错误 |
|---|
| 설명 | FeehiCMS 2.1.1 ships with an empty cookieValidationKey in all environment templates, including production (environments/prod/backend/config/main-local.php and environments/prod/frontend/config/main-local.php). The Yii2 framework uses this key to sign cookies via HMAC-SHA256. An empty key allows attackers to forge any Yii2-managed cookie, including identity cookies (when enableAutoLogin is enabled) and CSRF tokens.
The docker-entrypoint.sh init script does not auto-generate a random key, so Docker deployments use the empty key by default.
Impact:
Cookie integrity failure, potential authentication bypass, CSRF protection bypass.
Proof of Concept (theoretical):
An attacker can compute HMAC-SHA256(cookie_value, '') to forge a valid Yii2 cookie because the key is empty.
Remediation:
Auto-generate a random 32-byte key during init, add empty-key detection at startup, generate key in Docker entrypoint.
References:
- https://github.com/liufee/cms
- https://github.com/liufee/cms/issues/96
- Full report: https://github.com/yang5ynag/cve/blob/main/FEHI-003-Empty-cookieValidationKey.md |
|---|
| 사용자 | lyang (UID 100042) |
|---|
| 제출 | 2026. 07. 22. AM 08:25 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 06. AM 10:59 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399398 [liufee FeehiCMS 까지 2.1.1 Cookie Validation main-local.php cookieValidationKey 약한 암호화] |
|---|
| 포인트들 | 17 |
|---|