Description
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
aaPanel BillionMail
Default version status: unaffected
0 to ≤ 4.9affected
pkg:github/aaPanel/BillionMailReferences
- https://hackmd.io/@hieuPenguinnn/billionmail-unsubscribe-subscribe-jwt-deterministic-secret-forgery ↗
- https://github.com/aaPanel/BillionMail/blob/v4.9/core/internal/service/batch_mail/jwt.go#L98-L123 ↗
- https://github.com/aaPanel/BillionMail/blob/v4.9/core/manifest/config/config.yaml ↗
- https://github.com/aaPanel/BillionMail ↗
- https://www.vulncheck.com/advisories/billionmail-through-4.9-forgeable-jwts-via-default-signing-key ↗