Description
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
casdoor casdoor
Default version status: unaffected
0 to ≤ 4.4.0affected
pkg:github/casdoor/casdoorReferences
- https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-3-organization-admin-can-read-the-global-built-in-jwt-signing-private-key-via-apiget-certs-and-apiget-cert-incomplete-fix-of-3003--enables-cross-organization-token-forgery ↗
- https://github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.go ↗
- https://github.com/casdoor/casdoor/blob/v4.4.0/object/cert.go ↗
- https://github.com/casdoor/casdoor ↗
- https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpoints ↗