AJ-Report: Remote code execution via hard-coded JWT secret (CVE-2026-120209)

AJ-Report versions up to 1.7.1 utilize a hard-coded JSON Web Token (JWT) secret, which allows an attacker to forge valid Share-Tokens offline. Exploitation of this vulnerability permits unauthorized access to the testTransform endpoint. This endpoint insecurely passes user-supplied scripts to the GroovyClassLoader, resulting in unauthenticated remote code execution on the underlying server.

Attack Chain

1. Attacker identifies the hard-coded JWT secret within the AJ-Report application.
2. Attacker crafts a malicious Share-Token offline using the identified secret.
3. Attacker sends an HTTP request to the testTransform endpoint with the forged token.
4. The application validates the forged token as legitimate.
5. The testTransform endpoint processes the request, extracting reportCode parameters.
6. The application passes the reportCode 'dataSet' input to the GroovyClassLoader.
7. Arbitrary code is executed on the server under the context of the application process.

Impact

Successful exploitation allows for unauthenticated remote code execution, granting the attacker full control over the application server.

Recommendation

• Upgrade AJ-Report to a patched version beyond 1.7.1 immediately.
• Implement strict network segmentation for the reporting server to minimize exposure.
• Audit access logs for unauthorized attempts to reach the '/testTransform' endpoint.
• If patching is not immediately feasible, restrict network access to the testTransform endpoint at the web application firewall (WAF) or reverse proxy level.