[SUBMARINE-1417] Hard-coded JWT Key Vulnerability

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: Yu-Hsin Lai
• Created: 26/Mar/24 05:11
• Updated: 09/Apr/24 00:11

Description

A hard-coded JWT (JSON Web Token) key vulnerability has been discovered, specifically within org.apache.submarine.commons.utils.SubmarineConfVars.ConfVars#SUBMARINE_AUTH_DEFAULT_SECRET, where the key is hardcoded as SUBMARINE_SECRET_12345678901234567890. It will pose a significant security risk by allowing attackers to generate unauthorized JWT tokens, potentially enabling them to bypass authentication mechanisms and access sensitive data and functionalities.

Issue Links

• links to: GitHub Pull Request #1123
• links to: GitHub Pull Request #1124
• links to: GitHub Pull Request #1125