7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5fpv-5qvh-7cf3

GHSA-5fpv-5qvh-7cf3: NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary

The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI.

Affected Resources

HAXCMS.js HAXCMSClass

Impact

An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5fpv-5qvh-7cf3

GHSA-5fpv-5qvh-7cf3:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@haxtheweb/haxcms-nodejs	npm	< 11.0.10	11.0.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of default credentials for the HAX CMS application. The provided patch addresses this by modifying the application's initialization process. The analysis of the commit 6dc2441c876350ca6fe9fbaecb058d92ef442869 reveals that the changes are primarily in the HAXCMSClass within the file src/lib/HAXCMS.js.

The core of the vulnerability is in the application's setup routine. The patch adds code that checks for the existence of a user configuration file. If the file is not found, the application creates a default user with the username 'admin' and password 'admin' and writes these to a .user file. This logic is placed within the class's initialization code, which corresponds to the constructor.

Therefore, the HAXCMSClass.constructor is identified as the vulnerable function. It is the function that establishes the insecure state by setting up default credentials. An attacker doesn't need to exploit a flaw in a function's logic during runtime; they simply need to connect to a fresh installation of the application where the constructor has already run and created the default user account. The profiler would show this constructor being called during the application's startup sequence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-5fpv-5qvh-7cf3: NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary

Affected Resources

Impact

GHSA-5fpv-5qvh-7cf3:

7.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

GHSA-5fpv-5qvh-7cf3: NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary

Affected Resources

Impact

7.3

7.3

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI