The project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment instance or local testing environment to be used to access the backend management interfaces of a different affected instance.
An attacker who obtains or constructs an acceptable administrator Authorization token may bypass normal login authentication and gain administrator privileges. This vulnerability could allow an attacker to access system configurations, invoke backend management APIs, create administrator accounts, and ultimately take over the system backend.
Affected versions: all versions prior to 0.6.2.
Impact
The project’s identity authentication mechanism has a vulnerability. In affected versions, the system does not fully validate the identity token in the Authorization header, only checking its validity. As a result, administrator tokens generated in other deployment instances or local test environments may be used to access the backend management interfaces of another affected instance.
If an attacker obtains or constructs an acceptable administrator Authorization token, they may bypass the target system’s normal login authentication and gain administrator privileges. This vulnerability could allow the attacker to access system configurations, invoke backend management interfaces, create administrator users, and ultimately take over the system backend.
Affected versions: all versions prior to 0.6.2.
Patch
This issue has been fixed in version 0.6.2.
Users are advised to upgrade to version 0.6.2 or later as soon as possible.
Temporary Mitigations
Before upgrading, users are advised to implement the following temporary measures:
- Set the environment variable
JWT_SECRET_KEY to a non-default value, and configure a unique, sufficiently strong JWT/authentication key for each deployment instance.
- Do not expose backend management interfaces directly to the public network.
References
- Public issue: #673
- Fix version: 0.6.2
- Fix commit: 1e8b20e
Acknowledgments
Thanks to @Gal0nYu for reporting this issue.
Gal0nYu Reporter
The project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment instance or local testing environment to be used to access the backend management interfaces of a different affected instance.
An attacker who obtains or constructs an acceptable administrator Authorization token may bypass normal login authentication and gain administrator privileges. This vulnerability could allow an attacker to access system configurations, invoke backend management APIs, create administrator accounts, and ultimately take over the system backend.
Affected versions: all versions prior to 0.6.2.
Impact
The project’s identity authentication mechanism has a vulnerability. In affected versions, the system does not fully validate the identity token in the Authorization header, only checking its validity. As a result, administrator tokens generated in other deployment instances or local test environments may be used to access the backend management interfaces of another affected instance.
If an attacker obtains or constructs an acceptable administrator Authorization token, they may bypass the target system’s normal login authentication and gain administrator privileges. This vulnerability could allow the attacker to access system configurations, invoke backend management interfaces, create administrator users, and ultimately take over the system backend.
Affected versions: all versions prior to 0.6.2.
Patch
This issue has been fixed in version 0.6.2.
Users are advised to upgrade to version 0.6.2 or later as soon as possible.
Temporary Mitigations
Before upgrading, users are advised to implement the following temporary measures:
JWT_SECRET_KEYto a non-default value, and configure a unique, sufficiently strong JWT/authentication key for each deployment instance.References
Acknowledgments
Thanks to @Gal0nYu for reporting this issue.