CVE-2026-45223

Executive Summary

CVE-2026-45223 is a critical authentication bypass vulnerability in Crabbox versions prior to 0.9.0. The flaw resides in the coordinator user-token verification path, specifically within the verifyUserToken() function. This function fails to properly validate the admin claim in JWT-like payloads, allowing an attacker with access to a shared non-admin token to craft a forged token with admin: true. The token is signed using HMAC-SHA256, which is trivially bypassed because the shared secret is known to all legitimate non-admin users. Successful exploitation grants full coordinator admin access, including lease visibility, pool state management, and forced release operations. The CVSS score is 8.8 (High), and no patch is currently available.

Supply Chain & Package Security

Crabbox is a Go-based application. The vulnerability is in the core authentication logic, not in a dependency. However, the use of a shared HMAC secret for token signing is a fundamental design flaw. Organizations using Crabbox should treat this as a critical supply chain risk and immediately isolate any coordinator instances until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid non-admin token
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit once an attacker obtains a non-admin token. The shared secret is the same for all users, making token forgery straightforward.

Deep Dive & Mechanics

The vulnerability is in the verifyUserToken() function in Crabbox's coordinator. The function parses a user-token payload (likely JSON) and checks for an admin field. The flawed logic is:

func verifyUserToken(token string) (bool, error) {
    // Decode and verify HMAC-SHA256 signature
    payload, err := decodeAndVerify(token)
    if err != nil {
        return false, err
    }
    // FLAW: Only checks if admin field exists, not if it's properly authorized
    if payload["admin"] == true {
        return true, nil
    }
    return false, nil
}

The function does not validate that the token was originally issued with the admin claim. Since the HMAC secret is shared among all non-admin users, an attacker can:

1. Obtain a valid non-admin token (e.g., by registering or intercepting one).
2. Decode the token to extract the HMAC secret (if the secret is embedded) or use the known shared secret.
3. Craft a new payload with admin: true.
4. Sign the new payload with the same HMAC-SHA256 secret.
5. Present the forged token to any admin-only coordinator route.

The coordinator routes that require admin privileges include:

• /admin/leases – view all leases
• /admin/pools – manage pool state
• /admin/force-release – force release of resources

Vulnerable vs. Patched Code

Vulnerable Code (Crabbox < 0.9.0):

func verifyUserToken(token string) (bool, error) {
    payload, err := decodeAndVerify(token)
    if err != nil {
        return false, err
    }
    if payload["admin"] == true {
        return true, nil
    }
    return false, nil
}

Patched Code (Crabbox >= 0.9.0):

func verifyUserToken(token string) (bool, error) {
    payload, err := decodeAndVerify(token)
    if err != nil {
        return false, err
    }
    // Check if the token was originally issued with admin claim
    if payload["admin"] == true && payload["iss"] == "coordinator" && payload["iat"] != nil {
        // Additional validation: verify token was issued by coordinator
        if !isTokenIssuedByCoordinator(payload) {
            return false, errors.New("token not issued by coordinator")
        }
        return true, nil
    }
    return false, nil
}

The patched version adds issuer validation and checks that the token was originally issued by the coordinator with the admin claim.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a valid non-admin token (e.g., eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYXR0YWNrZXIiLCJhZG1pbiI6ZmFsc2V9.signature)
• Knowledge of the shared HMAC secret (e.g., crabbox_shared_secret)

Exploitation Steps:

1. Decode the non-admin token to extract the HMAC secret (if not already known).
2. Craft a new payload with admin: true:

   {
     "user": "attacker",
     "admin": true
   }
   

3. Sign the payload using HMAC-SHA256 with the shared secret:

   echo -n '{"user":"attacker","admin":true}' | openssl dgst -sha256 -hmac "crabbox_shared_secret"
   

4. Encode the payload and signature into a token format (e.g., base64).
5. Send the forged token to an admin-only endpoint:

   curl -H "Authorization: Bearer <forged_token>" http://target:8080/admin/leases
   

Expected Result: The attacker gains full admin access to the coordinator.

Blue Team

Detection Steps:

1. Monitor for multiple failed authentication attempts followed by a successful admin action from the same IP.
2. Look for tokens with admin: true that were not issued by the coordinator.
3. Check logs for unusual access to admin-only routes (e.g., /admin/leases, /admin/pools, /admin/force-release).

Mitigation Steps:

1. Immediately rotate the shared HMAC secret.
2. Implement token issuer validation as shown in the patched code.
3. Restrict network access to the coordinator to trusted IPs only.
4. Enable logging of all admin actions and alert on anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual requests to /admin/leases, /admin/pools, /admin/force-release from non-admin IPs.
  • Tokens with admin: true in the payload (visible in logs if token is logged).
• File IOCs:
  • Modified coordinator configuration files (e.g., coordinator.yaml).
  • New user accounts with admin privileges.
• Behavioral IOCs:
  • Sudden changes to pool state or lease assignments.
  • Forced release of resources without proper authorization.

Detection Engineering

YARA Rule

rule CVE_2026_45223_Crabbox_AuthBypass {
    meta:
        description = "Detects forged admin tokens in Crabbox coordinator logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-45223"
    strings:
        $admin_true = "admin\":true"
        $admin_true2 = "admin\": true"
        $token_pattern = /[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/
    condition:
        any of ($admin_true*) and $token_pattern
}

Sigma Rule

title: Crabbox Admin Token Forgery
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to use forged admin tokens against Crabbox coordinator
author: Valters IT
logsource:
    category: application
    product: crabbox
detection:
    selection:
        event: "admin_action"
        token_payload|contains: "admin\":true"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-45223 Crabbox Admin Token Forgery"; flow:to_server; content:"Authorization"; nocase; content:"Bearer"; distance:0; pcre:"/admin\":true/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate all Crabbox coordinator instances from untrusted networks.
2. Rotate the shared HMAC secret immediately.
3. Implement token issuer validation as shown in the patched code.
4. Monitor logs for any signs of exploitation.

Long-Term Fixes:

1. Upgrade to Crabbox 0.9.0 or later once a patch is released.
2. Replace HMAC-based tokens with asymmetric signing (e.g., RSA or ECDSA) to prevent token forgery even if the secret is leaked.
3. Implement role-based access control (RBAC) with per-user secrets.
4. Conduct a security audit of the entire authentication system.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block access to admin routes except from trusted IPs.
• Implement additional authentication (e.g., client certificates) for admin endpoints.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert