.NET CVE-2025-35940

This vulnerability presents HIGH real-world risk despite some mitigating factors. CVSS 8.1 with network-based attack vector (AV:N) and no privilege requirements (PR:N) indicates broad exploitability; however, AC:H (high complexity) suggests attackers must overcome some technical hurdle—likely discovering or reverse-engineering the hard-coded key. The vulnerability is NOT likely in CISA KEV (Known Exploited Vulnerabilities) catalog yet, but the low attack complexity barrier means public POC development is highly probable once details emerge. EPSS probability is likely elevated (>0.75) given the deterministic nature of JWT forgery once the key is known. SSVC perspective: exploitation is PROBABLE (key can be statically extracted), automatable (JWT forging is trivial), and technical impact is HIGH (complete authentication bypass). This is a priority vulnerability requiring immediate patching, particularly for externally-facing ArchiverSpaApi instances. The discrepancy between CVSS complexity and real-world ease suggests CVSS underweights the static-key discovery phase.

An attacker discovers or obtains the hard-coded JWT signing key through: (a) GitHub source code leak, (b) reverse engineering public ArchiverSpaApi binaries via tools like dnSpy, or (c) accessing exposed configuration files from misconfigured backups/logs. Armed with the key (e.g., 'SuperSecretKey123'), the attacker uses a JWT library (PyJWT, node-jsonwebtoken, or online tools) to craft a token with: payload={'sub': 'admin', 'role': 'administrator', 'iat': <current_time>, 'exp': <future_time>} and signs it using HMAC-SHA256 with the hard-coded key. The attacker then includes this forged token in HTTP requests to protected ArchiverSpaApi endpoints: Authorization: Bearer <forged_JWT>. ArchiverSpaApi's ASP.NET JWT middleware validates the signature using the same hard-coded key, successfully authenticates the attacker as an administrator, and grants access to sensitive endpoints (e.g., /api/admin/users, /api/documents/export). The attacker can then enumerate users, exfiltrate documents, modify records, or pivot laterally. Attack complexity is rated HIGH because discovering the key requires technical effort (decompilation, source code access), but once obtained, the forging process is trivial and no interactive elements are required. No POC code is referenced in available intelligence, but crafting one requires only publicly available JWT libraries and ~10 lines of code.