Authentication Bypass in Gravitee API Management via Default JWT Secret

Executive Summary

This vulnerability is an authentication bypass in Gravitee API Management through version 4.12.22. It allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the default jwt.secret. Attackers knowing a user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, gaining full platform control.

Useful 0 Not Useful 0

Detection Guidance

Check if the default JWT secret 'myJWT4Gr4v1t33_S3cr3t' is present in configuration files like gravitee.yml or environment variables. Inspect logs for warnings about default secrets. Verify JWT tokens used in API requests to see if they are signed with this default secret.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate administrators or any user to gain full control of the Gravitee API Management platform. This includes accessing sensitive data, modifying configurations, and disrupting services. The impact is severe due to the critical CVSS score of 9.2.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately rotate the JWT secret to a strong, unique value in the gravitee.yml configuration file. Disable any default users except the admin for recovery. Update all security headers in the configuration to restrictive values. Restart the Gravitee API Management service to apply changes.

Useful 0 Not Useful 0