Hard-Coded JWT Secret in FastapiAdmin

Executive Summary

FastapiAdmin through version 3.0 has a hard-coded JWT signing secret in its configuration file. This allows low-privileged users to register via an unauthenticated endpoint, log in, and forge an HS256 token impersonating the superuser by setting their session ID and using the superuser's username. This grants unauthorized superuser privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for hard-coded JWT secrets in FastapiAdmin's configuration file at backend/app/config/setting.py. Look for the JWT_SECRET_KEY or similar variable. Also inspect network traffic for unauthenticated POST requests to /api/v1/system/user/register endpoint.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain full administrative access to the FastapiAdmin application. This includes accessing sensitive data, modifying system configurations, and performing actions reserved for superusers without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of trust in systems handling protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FastapiAdmin to a patched version if available. If not, remove the hard-coded JWT secret from setting.py and implement a secure secret generation method. Disable the /api/v1/system/user/register endpoint if not required.

Useful 0 Not Useful 0