Crawlab
Monthly
Unauthenticated remote attackers can forge administrator JSON Web Tokens in Crawlab through 0.6.3 because the application ships a static HMAC-SHA256 signing secret that operators cannot override through configuration files or environment variables; forged tokens grant access to administrative APIs and, from there, code execution on worker nodes. Affected are all deployments of Crawlab 0.6.3 and earlier, including default installations, with the only prerequisite being network reachability to the admin API and no user interaction or authentication required (CVSS:4.0 base 9.3, PR:N; independent assessment CVSS:3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). EPSS is currently low at 0.53% (43rd percentile), and no public exploit code has been identified at time of analysis, but the flaw is trivial to exploit for anyone who has read the source, making this a genuine high-priority critical rather than an inflated-CVSS artifact.
Broken object-level authorization on Crawlab's password-change endpoint allows any authenticated user to overwrite the credentials of any platform account, including administrators, without ownership or role verification. The attack is a two-step IDOR chain: enumerate user IDs through an unrestricted user-listing endpoint, then submit a password-change request targeting the administrator account ID. Once administrator access is seized, full platform control enables deployment of malicious crawler scripts, achieving arbitrary code execution across all distributed worker nodes. No public exploit has been identified at time of analysis, though the IDOR pattern is trivially reproducible by any holder of a valid session.
Unauthenticated remote attackers can forge administrator JSON Web Tokens in Crawlab through 0.6.3 because the application ships a static HMAC-SHA256 signing secret that operators cannot override through configuration files or environment variables; forged tokens grant access to administrative APIs and, from there, code execution on worker nodes. Affected are all deployments of Crawlab 0.6.3 and earlier, including default installations, with the only prerequisite being network reachability to the admin API and no user interaction or authentication required (CVSS:4.0 base 9.3, PR:N; independent assessment CVSS:3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). EPSS is currently low at 0.53% (43rd percentile), and no public exploit code has been identified at time of analysis, but the flaw is trivial to exploit for anyone who has read the source, making this a genuine high-priority critical rather than an inflated-CVSS artifact.
Broken object-level authorization on Crawlab's password-change endpoint allows any authenticated user to overwrite the credentials of any platform account, including administrators, without ownership or role verification. The attack is a two-step IDOR chain: enumerate user IDs through an unrestricted user-listing endpoint, then submit a password-change request targeting the administrator account ID. Once administrator access is seized, full platform control enables deployment of malicious crawler scripts, achieving arbitrary code execution across all distributed worker nodes. No public exploit has been identified at time of analysis, though the IDOR pattern is trivially reproducible by any holder of a valid session.