An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
The application uses a fixed, hardcoded value "secret" as the HMAC key for signing JWT tokens. Since the secret is publicly known and identical in every installation, an attacker without any credentials can independently generate properly signed JWT tokens. These tokens will be accepted by the application as authentic, allowing the attacker to impersonate any user or gain access to protected resources and operations.
An attacker can obtain unauthorized access to sensitive information and perform privileged operations in the application by forging valid JWT tokens. The vulnerability threatens both data confidentiality and system integrity.
The @evershop/evershop package should be updated to version 1.0.0-rc.8 or newer, in which the HMAC secret is no longer hardcoded. Additionally, it is recommended to invalidate all previously issued JWT tokens and enforce user re-authentication after the update.
NPM package @evershop/evershop in versions prior to 1.0.0-rc.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NEvershop
APPEvershop1.0.0
Related vulnerabilities
EverShop: token resetowania hasła ujawniany w odpowiedzi API
Second-order SQL injection w EverShop podczas obsługi kategorii
RCE i ujawnienie danych w EverShop NPM przez plik route.json
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaus...
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via t...