Hardcoded JWT Secret in Peppermint Allows Session Forgery

Executive Summary

Peppermint through version 0.5.5 has a hardcoded JWT signing secret in its docker-compose.yml file. This allows unauthenticated attackers to forge session tokens for any account by using the exposed secret to create valid tokens for arbitrary user IDs. This bypasses authentication and grants access to protected endpoints without credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for hardcoded JWT secrets in docker-compose.yml files, especially in Peppermint deployments. Search for 'jwt-secret' or similar keys in configuration files. Verify if the secret matches known hardcoded values from the CVE disclosure.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate any user, including administrators, to access sensitive data or perform unauthorized actions. This could lead to data breaches, unauthorized modifications, or complete system compromise. The impact depends on the privileges of the impersonated accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (data confidentiality) and HIPAA (patient data security). It enables unauthorized access to sensitive data, which could result in regulatory penalties, legal consequences, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Rotate the JWT signing secret immediately by updating docker-compose.yml with a new random secret. Restart Peppermint services to apply changes. Ensure no previous tokens remain valid by implementing token revocation or short expiration times.

Useful 0 Not Useful 0