提交 #881826: vas3k TaxHacker main Use of Weak Credentials

TaxHacker uses better-auth for JWT-based session management. The BETTER_AUTH_SECRET environment variable in lib/config.ts:13-16 has a hardcoded default value 'please-set-your-key-here' via Zod schema .default() [0†L10-L12][0†L19-L23]. When this environment variable is not explicitly set in deployment, the system uses this weak, publicly-known default to sign JWT session tokens [0†L4-L8]. The parsed value flows to config.auth.secret (lib/config.ts:67-68) and is passed to better-auth's constructor in lib/auth.ts:29, which uses JWT strategy for session management (lib/auth.ts:35-38) [0†L14-L16][0†L27-L30].

An attacker aware of this default secret can forge valid JWT tokens using HS256, bypass authentication, and access the system as any user [0†L7-L9][0†L16-L18].

Core vulnerable code path:
- lib/config.ts:13-16 - Zod schema defines BETTER_AUTH_SECRET with default 'please-set-your-key-here' [0†L19-L23]
- lib/config.ts:25-29 - envSchema.parse() uses Zod defaults for unset variables [0†L12-L13]
- lib/config.ts:67-68 - config.auth.secret receives the weak default [0†L24-L25]
- lib/auth.ts:29-38 - better-auth uses this secret as JWT signing key with JWT session strategy [0†L27-L30]

POC:
1. Target deployment does not set BETTER_AUTH_SECRET environment variable (uses the default) [0†L31-L32].
2. Attacker forges a JWT token using the known default secret 'please-set-your-key-here' with a known user ID, signed with HS256 [0†L33-L36].
3. Attacker sends request with forged token: GET /transactions/ with Cookie: taxhacker-session-token=<forged_token> [0†L37-L38].
Expected result: Server accepts the forged JWT token and returns the user's transaction data, confirming authentication bypass [0†L38-L39].

Impact:
Complete authentication bypass [0†L39-L40]. An attacker can:
- Access any user's financial data (transactions, files, settings) [0†L40-L41]
- Create, modify, or delete transactions [0†L41]
- Upload and download files [0†L42]
- Access all API endpoints [0†L42]
- Execute AI analysis [0†L42-L43]
- Export user data [0†L43]

This is a fundamental security flaw that undermines all access control in the application [0†L43-L44].

Remediation:
- Remove the default value from the Zod schema in lib/config.ts, making BETTER_AUTH_SECRET a required environment variable [0†L44-L46]
- Add a startup check that validates the JWT secret meets minimum entropy requirements [0†L46-L47]
- Update .env.example with a strong randomly generated default and clear warning [0†L47-L48]
- Implement configuration validation at application startup that rejects weak or default secrets [0†L48-L49]

References:
https://github.com/vas3k/TaxHacker/issues/147
CWE: CWE-1391 Use of Weak Credentials / CWE-321 Use of Hard-coded Cryptographic Key
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Score: 9.8)

• 来源: ⚠️ https://github.com/vas3k/TaxHacker/issues/147
• 用户: keyblue (UID 96875)
• 提交: 2026-07-07 03時22分 (2 月前)
• 管理: 2026-08-22 12時56分 (2 months later)
• 状态: 已接受
• VulDB条目: 394302 [vas3k TaxHacker 直到 0.8.2 JWT Secret lib/config.ts envSchema.parse BETTER_AUTH_SECRET 弱身份验证]
• 积分: 20