Haxcms — CraftedSignal Threat Feed

HAXcms Cross-Tenant Account Takeover via Stored XSS and Token Exposure

hello@craftedsignal.io — Tue, 19 May 2026 14:48:29 +0000

HAXcms is vulnerable to a critical account takeover vulnerability stemming from a combination of stored XSS and insecure token handling. The vulnerability, present in versions 25.0.0 and earlier, allows an authenticated attacker to inject malicious JavaScript code into a page that, when viewed by another user, exfiltrates that user’s authentication tokens. The /system/api/connectionSettings endpoint dynamically leaks sensitive tokens into a global JavaScript variable (window.appSettings), which can be accessed and stolen via XSS. This vulnerability allows for complete cross-tenant account hijacking, enabling attackers to perform administrative actions without needing the victim’s password.

Attack Chain

Attacker authenticates to the HAXcms application with valid credentials.
Attacker injects malicious JavaScript code via a stored XSS vulnerability, such as within an iframe’s srcdoc or through a tag, on a page they have write access to.
The victim user views the compromised page.
The injected JavaScript executes in the victim’s browser context.
The JavaScript fetches the victim’s connection settings via fetch('//system/api/connectionSettings'), which includes the victim’s valid JWT and tokens.
The JavaScript parses the jwt, user_token, site_token, and appstore_token from the response.
The JavaScript encodes the stolen tokens (including jwt, user_token, site_token, and appstore_token) using Base64 encoding.
The JavaScript exfiltrates the encoded tokens to an attacker-controlled webhook using an image request to bypass CORS. The attacker now has the ability to impersonate the victim and perform administrative actions.

Impact

This vulnerability allows for complete account hijacking. An attacker who successfully exploits this vulnerability can impersonate a victim user without needing their password. This gives the attacker the ability to perform malicious administrative actions, such as creating or deleting sites, modifying user access, and uploading malicious content. The reliance on window.appSettings for storing long-lived administrative tokens creates a critical vulnerability when combined with XSS.

Recommendation

Deploy the Sigma rule Detect HAXcms Connection Settings Request to detect requests to the /system/api/connectionSettings endpoint from unusual sources, and tune for your environment.
Deploy the Sigma rule Detect HAXcms Token Exfiltration via Webhook to detect attempts to exfiltrate the tokens to external webhooks.
Ensure that all HAXcms instances are updated to a patched version that addresses this vulnerability to prevent CVE-2026-46511 exploitation.

HAXcms Node.js Backend Private Key Disclosure via Broken HMAC Implementation

hello@craftedsignal.io — Tue, 19 May 2026 14:46:30 +0000

The hmacBase64() function in the HAXcms Node.js backend contains two critical cryptographic implementation errors. First, the function passes the literal string “0” as the HMAC signing key instead of the intended key parameter, resulting in identical HMACs across all HAXcms instances for the same input. Second, after computing the HMAC, the function concatenates the actual signing secret (this.privateKey + this.salt) directly onto the output. This design flaw allows any unauthenticated attacker to extract the system’s private signing key, forge arbitrary admin-level JSON Web Tokens (JWTs), and gain full admin access with a single HTTP request. The vulnerability affects @haxtheweb/haxcms-nodejs versions 25.0.0 and earlier. This vulnerability is tracked as CVE-2026-46395.

Attack Chain

The attacker sends an unauthenticated GET request to the /system/api/connectionSettings endpoint.
The server responds with JSON data containing multiple tokens generated by the flawed hmacBase64() function.
The attacker extracts one of these tokens from the response.
The attacker base64-decodes the token.
The attacker discards the first 32 bytes of the decoded token (the HMAC).
The attacker reads the remaining bytes as a UTF-8 string, which contains the privateKey+salt secret.
The attacker uses the extracted privateKey+salt to forge a JWT with admin privileges using JWT.sign(payload, this.privateKey+this.salt). The forged JWT contains a payload specifying id, user (set to “admin”), iat (current timestamp), and exp (expiration timestamp).
The attacker uses the forged JWT to access authenticated endpoints, performing actions such as creating, modifying, or deleting sites, and uploading files.

Impact

Successful exploitation allows an unauthenticated attacker to gain full administrative control over a HAXcms instance. The attacker can create, modify, or delete sites, upload arbitrary files, and modify content without any login events being recorded. This attack bypasses any strong passwords set by the administrator. The vulnerability affects @haxtheweb/haxcms-nodejs versions 25.0.0 and earlier.

Recommendation

Deploy the Sigma rule to detect requests to the /system/api/connectionSettings endpoint as an early warning of exploitation attempts.
Apply patches or updates provided by HAXtheWeb for @haxtheweb/haxcms-nodejs to address CVE-2026-46395.
Monitor web server logs for abnormally long tokens which can indicate exploitation, correlate with the HAXcms Node.js Token Length Anomaly Sigma rule.

HAXcms createSite SSRF Enables Arbitrary File Read

hello@craftedsignal.io — Tue, 19 May 2026 14:44:52 +0000

HAXcms (v11.0.6) is vulnerable to Server-Side Request Forgery (SSRF) via the createSite endpoint due to insufficient validation of the build.files parameter. An authenticated user can supply arbitrary URLs or local file paths, which are then fetched server-side using file_get_contents() without validation. This allows for reading arbitrary files, accessing internal network services, and potentially exposing cloud credentials through metadata endpoints. This vulnerability was disclosed in GHSA-q862-gcgq-5m6g and is tracked as CVE-2026-46393. Exploitation requires an authenticated session, but default credentials are often present on fresh installs, lowering the barrier to entry.

Attack Chain

Attacker authenticates to the HAXcms application using credentials (default admin/admin may work on fresh installs).
The attacker obtains a valid JWT and CSRF token from the authenticated session.
The attacker crafts a POST request to the /createSite endpoint with a JSON payload.
The payload includes a build.files parameter containing a filename (e.g., poc.txt) as the key and a tmp_name value set to the target URL or file path (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ or /etc/passwd).
The HAXcms server processes the build.files parameter, extracting the tmp_name value without validation.
The server uses file_get_contents() to fetch the content from the URL or file path specified in tmp_name.
The fetched content is saved to the sites//files/ directory.
The attacker retrieves the content by sending a GET request to sites//files/, thus achieving arbitrary file read or access to internal resources.

Impact

This SSRF vulnerability can be exploited by any authenticated user to access sensitive information. Successful exploitation allows attackers to read arbitrary files from the server’s file system (e.g., /etc/passwd, application configuration files), access internal network services, and potentially expose cloud credentials through metadata endpoints like http://169.254.169.254. This could lead to complete compromise of the server and potentially the associated cloud environment. The affected package npm/@haxtheweb/haxcms-nodejs (vulnerable: <= 25.0.0) means that many instances of HAXcms may be affected.

Recommendation

Apply available patches or updates to HAXcms to address CVE-2026-46393.
Monitor web server logs for POST requests to /createSite with suspicious URLs or file paths in the build.files parameter, using the Sigma rule Detect HAXcms createSite SSRF Attempt.
Inspect network connections originating from the HAXcms server for connections to internal IP addresses or cloud metadata endpoints like 169.254.169.254, as highlighted in the IOC section.
Implement strict input validation on the build.files parameter of the /createSite endpoint to prevent arbitrary URL and file path injection.