Critical Vulnerability in Bambuddy: Hardcoded Secret Key and Insecure API Endpoints
Summary
GHSA-gc24-px2r-5qmf: Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication. Affects bambuddy versions < 0.1.6.2. Fixed in 0.1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bambuddy is an open-source application designed for managing 3D printing tasks and related operations. It offers features such as user management, printer control, and system monitoring. However, it has been found to contain serious security flaws, including a hardcoded secret key for signing JWTs and multiple API endpoints that do not require authentication, making it susceptible to unauthorized access and control.
Vulnerability Detail
The vulnerability arises from two main issues: the presence of a hardcoded secret key in the source code and the lack of authentication checks on many API routes. The hardcoded JWT secret key allows attackers to forge valid JWT tokens, enabling them to bypass authentication and gain administrative access to any Bambuddy instance. Additionally, numerous API endpoints can be accessed without any authentication, further exacerbating the risk of unauthorized actions.
How To Fix
Minimum fixed version
0.1.6.2
This is the first release that contains the fix.
pip install --upgrade "bambuddy==0.1.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the hardcoded secret key in the source code to a more secure, randomly generated key. This can be done by locating the key in 'backend/app/core/auth.py' and replacing it with a new key. However, this is not a permanent solution, and users should still update to the patched version as soon as possible.
Conclusion
The Bambuddy application has a critical vulnerability due to a hardcoded secret key and unsecured API endpoints. Users are strongly advised to update to the latest version to mitigate risks associated with unauthorized access and control. Implementing proper security measures is essential to protect sensitive data and maintain the integrity of the application.
See every vulnerability recorded for bambuddy →
FAQ
The vulnerability has a CVSS score of 9.8, indicating it is critical and poses a significant risk to users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, attackers can gain unauthorized access to sensitive data, control printers, and perform administrative actions within the Bambuddy application.
Yes, you can temporarily change the hardcoded secret key in the source code to a more secure key, but this should not replace updating to the patched version.
If immediate updating is not possible, ensure that your instance of Bambuddy is not exposed to the internet and restrict access to trusted users only.
