Clawvet API Secret Flaw Exposed

A critical security vulnerability identified in the self-hosted version of the clawvet API server has exposed a fundamental flaw in how the platform handles session authentication. The issue, which allows unauthenticated remote access, stems from a hard-coded fallback secret present in the codebase prior to the release of version 0.7.5.

An Insecure Default Configuration

The core of the issue lies within auth.ts, where a static JWT secret, identified as 'clawvet-dev-secret-change-me', was implemented as a fallback mechanism. This same insecure string was also distributed as a default value in the .env.example file. Because this secret is publicly known through the codebase, it facilitates the forging of session cookies.

Exploitation Through API Access

The vulnerability sequence allows an attacker to operate without valid credentials by exploiting the lack of authentication on specific endpoints. The attack path functions as follows:

• The GET /api/v1/scans endpoint returns records containing userId values without requiring authentication.
• Attackers can harvest these userId values to initiate further actions.
• Using the known clawvet-dev-secret-change-me string, an attacker can perform an offline forge of a valid HS256 cg_session cookie.
• This forged cookie can then be used to query the GET /api/v1/auth/me endpoint, returning the victim's email, subscription plan, and secret apiKey.

Scope and Technical Severity

The disclosure specifies that the threat is isolated to the self-hosted API server component, specifically those running versions earlier than 0.7.5. It is important to note that the flaw does not extend to the entirety of the project; the published clawvet npm package, which is limited to the CLI, remains unaffected by this specific vulnerability.

Implications for Self-Hosted Deployments

For organizations maintaining self-hosted instances, this finding indicates a significant risk to user privacy and account security. The ability for an unauthenticated party to retrieve sensitive information like apiKey values suggests that once an account is compromised, the attacker may gain access to further data or services managed under that specific user identity. Users are advised to verify their current version to ensure they are no longer relying on the vulnerable fallback configuration.