| Title | PMWeb v7.x, v8.x, v2025.x Use of Hard-coded Cryptographic Key |
|---|
| Description | Title:
Hardcoded Encryption and Machine Key Enabling Mass Exploitation
A vulnerability was identified in PMWEB Project Management Platform involving the use of a hardcoded cryptographic key and a shared ASP.NET machine key across all deployments of the application. The key material, stored within encryptionhelper.dll and the application's machine key configuration, is identical across every PMWEB installation rather than being generated uniquely per instance.
Because the same key material is shared universally, an attacker who extracts the key from any single PMWEB deployment can reuse it against every other PMWEB server running the same version, without needing to compromise each target individually. This enables mass exploitation: a single key disclosure event can be leveraged to forge encrypted request parameters, and in the case of a shared ASP.NET machine key, to forge ViewState or authentication tickets accepted as valid by any PMWEB instance, regardless of which deployment the key was originally obtained from.
This significantly amplifies the impact of any individual key compromise, converting a single-instance issue into an organization-wide or industry-wide risk across all customers running the affected shared key configuration.
POC Steps
1. Obtain a copy of encryptionhelper.dll and/or the application's machine key configuration from a single PMWEB server instance.
2. Extract the hardcoded cryptographic key and/or machine key values from the obtained file(s).
3. Use the extracted key material to encrypt or sign a request parameter, ViewState payload, or authentication token as would be accepted by a PMWEB server.
4. Submit the forged request to a separate, independent PMWEB server instance running the same shared key configuration.
5. Confirm that the second, previously untouched PMWEB instance accepts the forged request as valid, demonstrating that key material obtained from one deployment is usable against unrelated deployments.
Credits
The following individuals and organizations are credited for the discovery and coordination of these findings:
● Abdullah AlJaber
● Abdulmajeed AlDayel
● Mohammad AlHumaid
● Saudi Arabia National Cybersecurity Authority (NCA)
● Saudi Information Technology Company (SITE) |
|---|
| User | aljaber (UID 99098) |
|---|
| Submission | 08/15/2026 02:28 (1 month ago) |
|---|
| Moderation | 09/27/2026 20:48 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410955 [PMWeb v7.x/v8.x/v2025.x encryptionhelper.dll information disclosure] |
|---|
| Points | 17 |
|---|