AstrBot Hardcoded JWT Secret Vulnerability Allowing Remote Code Execution

A vulnerability exists in AstrBot versions through 3.5.15, where a hardcoded private key is used to sign JSON Web Tokens (JWT). This exposure allows for unauthorized plugin uploads, which can lead to remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where AstrBot is running.

Reproduction

To reproduce this vulnerability, upload a malicious plugin that exploits the hardcoded JWT secret. This can be done by sending a request to the AstrBot server with the crafted JWT that includes the signed payload using the exposed secret. The server will then execute the code in the uploaded plugin, resulting in remote code execution.