Sanluan PublicCMS Hard-Coded Cryptographic Key Vulnerability in Private File Access Control

A vulnerability exists in Sanluan PublicCMS version 5.202506.d, specifically within the SafeConfigComponent's getSignKey function. The issue arises because the privatefile_key argument is manipulated, leading to the use of a hard-coded cryptographic key. This vulnerability allows remote attackers to bypass private file access controls and download restricted files without authentication, as the default signing key can be predicted and forged. The problem is exacerbated by the exposure of the cluster identifier through an unauthenticated API, which can be used to derive the signing key offline.

Impact

Exploitation of this vulnerability allows remote, unauthenticated attackers to download private files without authorization, potentially leading to unauthorized access to sensitive information. The vulnerability could be exploited by leveraging knowledge of the private file path, which may be inadvertently disclosed through various channels.

Reproduction

To reproduce this vulnerability, first obtain the cluster identifier from the '/api/directive/tools/version' endpoint. Then, derive the default signing key using the known algorithm that incorporates the site ID, a hash of the CMS file path, and the cluster value. Once the signing key is obtained, forge a valid signature for the '/file/private' endpoint by including the expiry, file path, and the forged sign parameter. The request can then be sent to download the private file without authentication.

Remediation

To address this vulnerability, it is recommended to require a high-entropy, randomly generated privatefile_key for each site during installation. Remove predictable fallback keys based on public values and avoid exposing internal identifiers that could assist in key derivation. Additionally, replace the current signing mechanism with HMAC-based signing using a strong secret key, rotate existing private file signing keys, and invalidate historical signed URLs.