CVE-2021-40494: Hardcoded JWT Secret Key in AdaptiveScale LXDUI
Summary
CVE-2021-40494: A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system. Affects lxdui versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AdaptiveScale LXDUI is a PyPI package that provides a user interface for managing LXD containers. It allows users to interact with the LXD daemon and perform various container management tasks. LXDUI is commonly used in environments where containerization is employed to isolate applications and services. However, a vulnerability has been identified in LXDUI versions up to 2.1.3 that could allow attackers to gain admin access to the host system.
Vulnerability Detail
The vulnerability (CVE-2021-40494) resides in the metadata.py file of AdaptiveScale LXDUI. It involves the presence of a hardcoded JWT (JSON Web Token) secret key. This secret key is used for authentication and authorization purposes within the application. By obtaining this secret key, an attacker can forge valid JWTs and gain administrative access to the host system. This could lead to unauthorized control over the containers and potentially compromise the entire infrastructure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can consider implementing additional security measures such as restricting network access to the LXDUI interface, enforcing strong passwords for user accounts, and regularly monitoring system logs for any suspicious activities.
Conclusion
In conclusion, AdaptiveScale LXDUI versions up to 2.1.3 are vulnerable to CVE-2021-40494, which allows attackers to gain admin access to the host system. To mitigate this vulnerability, users should update to LXDUI version 2.1.4 or later. Additional security measures can also be implemented to enhance the overall security of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxdui →
FAQ
AdaptiveScale LXDUI is a PyPI package that provides a user interface for managing LXD containers. It allows users to interact with the LXD daemon and perform various container management tasks.
The vulnerability allows attackers to gain admin access to the host system, potentially compromising the entire infrastructure and giving unauthorized control over the containers.
To fix this vulnerability, it is recommended to update AdaptiveScale LXDUI to version 2.1.4 or later, which includes a patch that removes the hardcoded JWT secret key and implements a more secure approach for generating and managing JWTs.
While there is no specific workaround provided, users can consider implementing additional security measures such as restricting network access to the LXDUI interface, enforcing strong passwords for user accounts, and regularly monitoring system logs for any suspicious activities.
There are alternative LXDUI packages available that can be used as a replacement for AdaptiveScale LXDUI. It is recommended to evaluate and choose a package that has a good track record of security and regular updates.
