HAXcms Node.js Unauthenticated Access Vulnerability Due to Insecure Default Configuration

A vulnerability exists in HAXcms with a Node.js backend, specifically in versions 11.0.6 and prior. The issue arises from an insecure default configuration intended for local development, which lacks necessary authorization and authentication checks. When deployed without modifications, the 'HAXCMS_DISABLE_JWT_CHECKS' setting is enabled, resulting in a lack of session authentication. This vulnerability allows unauthenticated remote attackers to access, modify, and delete all site information.

Impact

Exploitation of this vulnerability could lead to unauthorized access, modification, and deletion of site information.

Reproduction

To reproduce this vulnerability, install HAX CMS Node.js. The application will run with JWT checks disabled by default, allowing unauthenticated access.

Remediation

Users can upgrade to HAXcms version 11.0.7, which addresses this vulnerability by implementing proper authentication and authorization checks.