Hard-Coded HMAC Key in Snowy 3.6.5

Executive Summary

Snowy 3.6.5 has a hard-coded HMAC key vulnerability in its file download endpoint. The FILE_DOWNLOAD_SIGN_SECRET constant is exposed in the source code, allowing attackers to forge valid HMAC-SHA256 signatures for any file ID. This bypasses authentication and access controls, enabling unauthorized downloads of files like avatars, images, and attachments.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file downloads by monitoring access logs for the /dev/file/download endpoint. Look for requests without valid authentication tokens but with HMAC-SHA256 signatures. Inspect source code for the hard-coded key 'snowy_file_download_secret_key_2025' in DevFileServiceImpl.java.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to download sensitive files without authentication, potentially exposing private data such as user avatars, documents, or system files. The lack of proper authorization checks means even protected files marked as requiring download authorization can be accessed if a valid signature is forged.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Snowy to a patched version. Rotate the hard-coded HMAC key and regenerate all download signatures. Implement strict access controls for the /dev/file/download endpoint and enforce super-admin checks for file deletion.

Useful 0 Not Useful 0