Hard-Coded Credentials in AutoBangumi

Executive Summary

AutoBangumi versions before 3.2.8 contain a critical vulnerability involving hard-coded default credentials. When the users table in the database is empty, the application seeds default administrator credentials via the add_default_user() function. An unauthenticated attacker can use these publicly known default credentials to log in as an administrator without any authentication.

This allows the attacker to gain full control over the application, including managing RSS feed configurations, downloader settings, and accessing all authenticated API endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to gain full administrative access to the AutoBangumi application. With this access, the attacker can control critical application features such as RSS feed configuration and downloader settings.

Such control can lead to unauthorized changes, data manipulation, or disruption of service, potentially compromising the integrity and availability of the application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to authenticate to the AutoBangumi application's login endpoint using the publicly known default credentials seeded by the add_default_user() function when the users table is empty.

A practical detection method is to send an HTTP POST request to the authentication login endpoint with the default credentials and observe if access is granted.

For example, you can use the following curl command to test for the vulnerability:

• curl -X POST https://<target-host>/login -d '{"username":"default_username","password":"default_password"}' -H 'Content-Type: application/json' -v

Replace <target-host> with the target system's address and use the known default credentials as per the add_default_user() function. A successful authentication indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade AutoBangumi to version 3.2.8 or later, where this vulnerability has been addressed.

Until the upgrade can be applied, ensure that the users table in the database is not empty by creating a secure administrator account with a strong password to prevent the default credentials from being seeded.

Additionally, restrict access to the authentication login endpoint to trusted networks or through firewall rules to reduce exposure.

Useful 0 Not Useful 0