{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-120209/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aj-report:aj-report:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-120209"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AJ-Report (\u003c= 1.7.1)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","cve-2026-120209","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["AJ-Report"],"content_html":"\u003cp\u003eAJ-Report versions up to 1.7.1 utilize a hard-coded JSON Web Token (JWT) secret, which allows an attacker to forge valid Share-Tokens offline. Exploitation of this vulnerability permits unauthorized access to the testTransform endpoint. This endpoint insecurely passes user-supplied scripts to the GroovyClassLoader, resulting in unauthenticated remote code execution on the underlying server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies the hard-coded JWT secret within the AJ-Report application.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious Share-Token offline using the identified secret.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP request to the testTransform endpoint with the forged token.\u003c/li\u003e\n\u003cli\u003eThe application validates the forged token as legitimate.\u003c/li\u003e\n\u003cli\u003eThe testTransform endpoint processes the request, extracting reportCode parameters.\u003c/li\u003e\n\u003cli\u003eThe application passes the reportCode 'dataSet' input to the GroovyClassLoader.\u003c/li\u003e\n\u003cli\u003eArbitrary code is executed on the server under the context of the application process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution, granting the attacker full control over the application server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade AJ-Report to a patched version beyond 1.7.1 immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation for the reporting server to minimize exposure.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized attempts to reach the '/testTransform' endpoint.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, restrict network access to the testTransform endpoint at the web application firewall (WAF) or reverse proxy level.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T20:04:33Z","date_published":"2026-10-31T20:04:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aj-report-rce/","summary":"AJ-Report versions 1.7.1 and earlier contain a hard-coded JWT secret, enabling token forgery and unauthenticated remote code execution via the testTransform endpoint.","title":"AJ-Report: Remote code execution via hard-coded JWT secret (CVE-2026-120209)","url":"https://feed.craftedsignal.io/briefs/2026-10-aj-report-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-120209","version":"https://jsonfeed.org/version/1.1"}