AJ-Report JWT Secret Hard-Coded Remote Code Execution

Executive Summary

This vulnerability (CVE-2026-120209) affects AJ-Report versions up to 1.7.1. It involves a hard-coded JWT secret used to sign share tokens, allowing attackers to forge valid tokens offline. By crafting a token with reportCode 'dataSet', attackers can access the testTransform endpoint, which executes Groovy scripts via GroovyClassLoader without authentication, leading to remote code execution (RCE).

Useful 0 Not Useful 0

Detection Guidance

Check for AJ-Report versions 1.4.2 to 1.7.1. Inspect JWT token generation in JwtUtil.java for hard-coded secret 'aj-report'. Monitor network traffic for unauthorized access to /testTransform endpoint with reportCode 'dataSet'.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain unauthorized access to the AJ-Report server, execute arbitrary commands with the application's user privileges (often root), access all data sources, and potentially move laterally within the network. This could lead to data breaches, system compromise, or further attacks on connected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR (data protection) and HIPAA (health data security) due to unauthorized access to sensitive data and potential data exfiltration. Organizations using affected versions may face regulatory penalties, legal liabilities, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AJ-Report to a patched version beyond 1.7.1. Remove hard-coded JWT secret and replace with a strong, randomly generated key. Implement strict input validation for reportCode and enforce authentication checks. Add sandboxing for Groovy script execution.

Useful 0 Not Useful 0