An open API service providing security vulnerability metadata for many open source software ecosystems.

GSA_kwCzR0hTQS1mMzhmLWp2cWotbWZnNs4ABKWJ

Critical CVSS: 9.3 EPSS: 0.00059% (0.18656 Percentile) EPSS:

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

Affected Packages Affected Versions Fixed Versions
npm:@haxtheweb/haxcms-nodejs <= 11.0.6 11.0.7
0 Dependent packages
0 Dependent repositories
1,590 Downloads last month

Affected Version Ranges

All affected versions

0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.20, 9.0.21, 10.0.0, 10.0.1, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.6

All unaffected versions

11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15

Summary

The NodeJS version of HAX CMS uses an insecure default configuration designed for local
development. The default configuration does not perform authorization or authentication checks.

Details

If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication.

insecure-default-configuration-code

Affected Resources

PoC

To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without JWT checks enabled.

Impact

Without security checks in place, an unauthenticated remote attacker could access, modify, and delete all site information.

References: