PT-2025-3439 · Unknown · Macrozheng Mall-Tiny

Published 2025-01-31 · Updated 2025-09-02 · CVE-2024-57432

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macrozheng mall-tiny version 1.0.1

Description The issue concerns insecure permissions in the application. Specifically, the JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management. This makes it possible to forge the JWT of any user, allowing for authentication bypass.

Recommendations For macrozheng mall-tiny version 1.0.1, consider regenerating and securely storing the JWT signing keys to prevent unauthorized access. As a temporary workaround, restrict the use of user information in the JWT to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2024-57432

Affected Products

Macrozheng Mall-Tiny

References · 6

• 🔥 https://github.com/peccc/restful_vul/blob/main/mall_tiny_weak_jwt/mall_tiny_weak_jwt.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57432 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57432 · Vendor Advisory
• https://twitter.com/CVEnew/status/1885370171617124638 · Twitter Post
• https://t.me/cvedetector/16962 · Telegram Post
• https://t.me/cveNotify/134145 · Telegram Post