Listen to this Post
How the CVE Works
The vulnerability arises due to HAXCMS NodeJS’s default configuration setting HAXCMS_DISABLE_JWT_CHECKS=true, which disables JSON Web Token (JWT) validation. This misconfiguration skips authentication and authorization checks, allowing unauthenticated attackers to interact with the CMS as if they were privileged users. The issue stems from the assumption that the system is only used in local development, but if deployed in production without modification, it exposes all site data to unauthorized access, modification, or deletion.
DailyCVE Form
Platform: HAXCMS NodeJS
Version: Pre-1.0.5
Vulnerability: Missing Authentication
Severity: Critical
Date: 2023-05-15
Prediction: Patch by 2023-06-20
What Undercode Say
Check JWT status
grep "HAXCMS_DISABLE_JWT_CHECKS" config.js
Exploit curl (unauthenticated API access)
curl -X POST http://target/api/deleteSite -d '{"site":"example"}'
How Exploit
An attacker sends unauthenticated HTTP requests to HAXCMS APIs, bypassing JWT checks to manipulate or delete site content.
Protection from this CVE
- Set `HAXCMS_DISABLE_JWT_CHECKS=false`
– Update to HAXCMS NodeJS 1.0.5+ - Implement firewall rules
Impact
Full system compromise via unauthorized CMS modifications.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
