OpenDeepWiki 2.0.6以前で管理者トークンを偽造される脆弱性
Summary
OpenDeepWikiに、ログインなしで管理者になりすませる脆弱性が見つかりました。2.0.6以前を社内外に公開している組織が対象で、管理画面の外部到達を止めたうえで修正版への更新と鍵の交換を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
OpenDeepWikiに、ログインなしで管理者になりすませる脆弱性が見つかりました。2.0.6以前を社内外に公開している組織が対象で、管理画面の外部到達を止めたうえで修正版への更新と鍵の交換を進めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| AIDotNet | OpenDeepWiki |
≤ 2.0.6 |
— |
Original description The description as published by the source.
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory hackmd.io
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- report github.com
- web github.com
- web github.com
- web github.com