Hard-coded JWT Secret in Crawlab Vulnerability

Crawlab versions up to and including 0.6.3 contain a critical vulnerability involving the use of a hard-coded HMAC-SHA256 secret for signing JSON Web Tokens (JWT). Because this secret cannot be overridden via configuration files or environment variables, it remains static across all installations. An unauthenticated attacker with knowledge of this hard-coded secret can construct forged JWTs with administrative claims. By presenting these forged tokens to the application's authentication middleware, an attacker gains unauthorized access to administrative APIs. These APIs include functionality that allows for the scheduling and execution of tasks on worker nodes, effectively leading to unauthorized remote code execution (RCE). This vulnerability poses a severe risk to any environment hosting Crawlab, as it bypasses all standard authentication controls.

Impact

Successful exploitation allows for full administrative compromise of the Crawlab platform. Attackers can gain unrestricted access to sensitive configuration data, control over scheduled web crawling tasks, and the ability to execute arbitrary code on infrastructure running Crawlab worker nodes. This impact is platform-wide, affecting all deployments using versions 0.6.3 or earlier.

Recommendation

Prioritized actions for security teams:

• Identify and inventory all Crawlab instances currently running version 0.6.3 or earlier within the environment.
• Prioritize the immediate upgrade of all identified Crawlab instances to the latest available patched version where the JWT secret implementation has been remediated.
• Monitor web server logs for suspicious API requests carrying JWTs, specifically looking for anomalous administrative access patterns originating from unauthorized or external IP addresses.
• Enforce network-level segmentation to restrict access to Crawlab administrative interfaces, ensuring they are not exposed to the public internet.