CVE-2023-31579 Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key
Attackers can authenticate to the application by crafting JWT tokens using a hardcoded cryptographic key, leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31579?
CVE-2023-31579 is a critical vulnerability in n/a, published on 2 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
Weakness: CWE-798
Which versions are affected by CVE-2023-31579?
4 open source packages ship an affected version, including top.tangyh.basic:lamp-core and top.tangyh.basic:lamp-util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
top.tangyh.basic:lamp-core Maven | All versions | 3.8.1 |
top.tangyh.basic:lamp-core Maven | All versions | 3.8.1 |
top.tangyh.basic:lamp-util Maven | All versions | 3.8.1 |
top.tangyh.basic:lamp-util Maven | All versions | 3.8.1 |
Products include Tangyh Lamp-Cloud.
How do I fix CVE-2023-31579?
Upgrade top.tangyh.basic:lamp-core to 3.8.1 or later.
Is CVE-2023-31579 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31579 exists.
Sources
Also known as GHSA-xr8c-mq5x-5f56.