Casdoor Private Key Exposure Leading to JWT Forgery

Executive Summary

Casdoor through version 4.4.0 does not properly hide the instance-wide built-in certificate private key. This key can be retrieved by organization administrators via the /api/get-certs and /api/get-cert endpoints. Attackers with access to this key can forge JWT tokens for any user across all organizations, including global administrators.

Useful 0 Not Useful 0

Detection Guidance

Check if the endpoints /api/get-certs or /api/get-cert are accessible and return sensitive certificate private keys. Use tools like curl to query these endpoints: curl -X GET http://<target>/api/get-certs or curl -X GET http://<target>/api/get-cert. Monitor logs for unauthorized access to these endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you are an organization administrator or user of Casdoor, attackers could impersonate you or other users by forging JWT tokens. This could lead to unauthorized access to sensitive data, privilege escalation, or complete system compromise. Global administrators are particularly at risk as their tokens could grant access to all organizations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires protecting personal data and ensuring proper authentication, while HIPAA mandates secure access to health information. The exposure of private keys and ability to forge tokens could lead to unauthorized data access, resulting in non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Casdoor to a version later than 4.4.0 where the issue is fixed. Restrict access to the /api/get-certs and /api/get-cert endpoints to authorized users only. Rotate all exposed certificate private keys immediately to prevent token forgery.

Useful 0 Not Useful 0