Authentication Bypass in Simple Admin Core via Hard-Coded JWT Secret

Executive Summary

Simple Admin Core through version 1.8.7 has an authentication bypass flaw. Unauthenticated attackers can forge super administrator tokens using a hard-coded secret (Auth.AccessSecret) in the configuration file. By signing a JWT with this secret and a roleId claim of 001, attackers gain full administrative privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized JWT tokens signed with the hard-coded Auth.AccessSecret in api/etc/core.yaml. Inspect logs for roleId claim 001 in JWT tokens. Verify if any user has super administrator privileges without proper authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain complete control over the Simple Admin Core system. They can manipulate users, roles, menus, API authorities, configurations, and tokens without authentication. This could lead to unauthorized data access, system takeover, or further network compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access risks. GDPR mandates strict data protection and access controls, while HIPAA requires safeguards for sensitive health data. A breach could result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update Simple Admin Core to a version beyond 1.8.7. Remove or change the hard-coded Auth.AccessSecret in api/etc/core.yaml. Rotate all existing JWT tokens and invalidate any tokens with roleId claim 001.

Useful 0 Not Useful 0