Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate. The vulnerability is proven by existence of the issue in the live version as well. This issue can result in full account takeover of any user. Version 0.1.44 contains a patch.
Donetick uses JWT tokens for user authentication, however the default value of the secret used to sign tokens is weak and predictable. The responsibility for changing it rests with the system administrator, which in practice proves insufficient — confirmed by the fact that the vulnerability was present in the live production version of the application. By knowing or guessing the secret, an attacker can forge any JWT token and authenticate as the selected user.
An attacker without any privileges can forge a JWT token and take full control of any user account in the application.
The Donetick application should be updated to version 0.1.44, which contains a patch eliminating the weak default JWT secret issue. Instances updated before the patch was deployed should be checked to ensure the JWT secret has been changed to a strong and unique value.
Donetick in versions before 0.1.44
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDonetick
APPDonetick< 0.1.44