By obtaining this hard-coded secret, which is a known constant in default installations, an attacker can construct and sign JSON Web Tokens (JWTs). By including a 'roleId' claim set to '001', the attacker can successfully impersonate a super administrator. This grants the attacker unrestricted access to sensitive application functions, including user account management, role assignment, menu modification, API authority configuration, and the ability to generate or manipulate further authentication tokens. This vulnerability represents a total compromise of the application's access control mechanisms.

Impact

The vulnerability allows for complete administrative takeover of the Simple Admin Core application. An attacker can manipulate user accounts, modify system configurations, and intercept or create API authorities. Successful exploitation compromises the confidentiality, integrity, and availability of all data managed by the application, with a CVSS v3.1 base score of 9.8.

Recommendation

• Identify all instances of Simple Admin Core running in the environment and verify their version.
• Upgrade all Simple Admin Core instances to a version released after 1.8.7 where the hard-coded secret is removed or configurable via environment variables.
• Audit the 'api/etc/core.yaml' file on existing servers to confirm if the default hard-coded secret is in use.
• If immediate patching is not possible, rotate the secret in 'api/etc/core.yaml' to a unique, high-entropy value and restart the application services, noting that this may break existing legitimate sessions and require reconfiguration of any services relying on the previous secret.