EasyVirt DCScope and CO2Scope Weak JWT Secret Vulnerability Allowing Privilege Escalation

A vulnerability exists in EasyVirt DCScope versions through 8.6.0 and CO2Scope versions through 1.3.0, due to a weak JSON Web Token (JWT) secret. The HMAC secret for generating tokens is hardcoded as 'somerandomaccesstoken', which is predictable and allows remote attackers to create valid JWTs. This could be exploited for privilege escalation by impersonating users with elevated rights.

Impact

Exploitation of this vulnerability allows for unauthorized access by creating valid JWTs, enabling impersonation of users and potential manipulation of sensitive data, along with associated privileges.

Reproduction

To reproduce this vulnerability, use a Python script that generates a JWT using the hardcoded secret 'somerandomaccesstoken'. The script should create a token with a 24-hour validity, including a payload that specifies the user as 'root' and the role as 'admin'. Once the token is generated, it can be used to exploit the vulnerability by accessing the application with the forged JWT.