Listen to this Post
How the CVE Works
The vulnerability stems from missing authorization checks in HAX CMS API endpoints. While authentication is verified, the system fails to validate if a user has proper permissions before executing operations like deleteNode, getConfig, or cloneSite. An attacker with valid credentials can abuse these endpoints to manipulate other users’ sites, extract sensitive configurations (including cleartext credentials), or delete critical resources. For example, a POST request to `/deleteNode` with a stolen JWT and a target node ID allows unauthorized deletion.
DailyCVE Form
Platform: HAX CMS
Version: JS/PHP variants
Vulnerability: Authorization Bypass
Severity: Critical
Date: 2022-xx-xx
Prediction: Patch by Q3 2022
What Undercode Say
curl -X POST 'https://target.com/api/deleteNode' -H 'Authorization: Bearer <JWT>' -d '{"id":"victim_node"}'
import requests
headers = {'Authorization': 'Bearer <JWT>'}
requests.post('https://target.com/api/getConfig', headers=headers).text
How Exploit
1. Steal JWT via XSS/session hijacking.
2. Enumerate sites via `listSites`.
3. Modify/delete nodes using `deleteNode` or `saveNode`.
4. Expose credentials via `getConfig`.
Protection from this CVE
- Implement role-based access control (RBAC).
- Validate permissions per endpoint.
- Encrypt sensitive config data.
Impact
- Unauthorized site/node manipulation.
- Credential leakage via config.
- Data integrity compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
