Description
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenBMB StaffDeck
Default version status: unaffected
0 to ≤ 0.5.6affected
pkg:github/OpenBMB/StaffDeckReferences
- https://hackmd.io/@hieuPenguinnn/staffdeck-default-token-signing-secret-auth-bypass ↗
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/config.py#L10 ↗
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/security/auth.py#L96-L98 ↗
- https://www.vulncheck.com/advisories/openbmb-staffdeck-through-0.5.6-authentication-bypass-via-hard-coded-session-secret ↗