Listen to this Post
How the CVE Works
HAX CMS (NodeJS) ships with static default credentials for user and superuser accounts, alongside fixed JWT private keys. These secrets are publicly exposed in the `haxtheweb` GitHub repository. During installation, the system does not enforce credential changes, and the UI lacks options to modify them. Attackers extract these defaults from GitHub, gaining unauthorized access to unsecured instances. Compromised JWTs allow session hijacking, site manipulation, and privilege escalation.
DailyCVE Form
Platform: HAX CMS (NodeJS)
Version: Pre-1.0.0
Vulnerability: Hardcoded Credentials
Severity: Critical
Date: 2023-05-15
Prediction: Patch by 2023-07-30
What Undercode Say
Check for default JWT keys in config: grep -r "default_jwt_key" /var/www/haxcms/ Extract hardcoded credentials from GitHub: curl -s https://raw.githubusercontent.com/haxtheweb/haxcms/main/config/defaults.json | jq '.users'
How Exploit
1. Clone `haxtheweb/haxcms` GitHub repo.
2. Locate `defaults.json` for credentials/JWT keys.
3. Use `POST /login` with default credentials.
4. Forge JWTs via stolen private keys.
Protection from this CVE
- Manually regenerate JWT keys post-install.
- Delete default users via database.
- Update to HAX CMS >=1.0.0.
Impact
- Full admin compromise.
- Site defacement/data theft.
- RCE via plugin uploads.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
