CVE-2023-27583
📋 TL;DR
PanIndex versions before 3.1.3 use a hard-coded JWT key 'PanIndex', allowing attackers to forge authentication tokens and gain admin privileges. This affects all deployments of vulnerable PanIndex versions. Attackers can perform any administrative actions on the network disk directory index.
💻 Affected Systems
- PanIndex
📦 What is this software?
Panindex by Panindex Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the PanIndex instance with attacker gaining full administrative control, allowing data theft, modification, or destruction of indexed network disk contents.
Likely Case
Attackers forge admin JWT tokens to access, modify, or delete sensitive files and directories indexed by PanIndex.
If Mitigated
No impact if patched to version 3.1.3+ or JWT key is changed before compilation.
🎯 Exploit Status
Exploitation requires only knowledge of the hard-coded key and ability to craft JWT tokens, which is trivial with available libraries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.3
Vendor Advisory: https://github.com/px-org/PanIndex/security/advisories/GHSA-82wq-gmw8-g87v
Restart Required: Yes
Instructions:
1. Download PanIndex version 3.1.3 or later from GitHub releases. 2. Replace existing installation with patched version. 3. Restart the PanIndex service.
🔧 Temporary Workarounds
Change JWT Key in Source
allModify the hard-coded JWT key in PanIndex source code before compiling and deploying.
Edit source code to replace 'PanIndex' JWT key with a strong random value
Recompile and redeploy the modified PanIndex
🧯 If You Can't Patch
- Immediately isolate vulnerable PanIndex instances from untrusted networks
- Implement network-level authentication or IP whitelisting to restrict access
🔍 How to Verify
Check if Vulnerable:
Check PanIndex version - if earlier than 3.1.3, it is vulnerable. Also check if JWT key in configuration/source is still 'PanIndex'.Check Version:
Check PanIndex web interface or configuration files for version informationVerify Fix Applied:
Verify PanIndex version is 3.1.3 or later, and confirm JWT key is no longer 'PanIndex' in configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual admin login patterns
- Authentication attempts with forged JWT tokens
- Administrative actions from unexpected IP addresses
Network Indicators:
- JWT tokens containing 'PanIndex' key in authentication requests
- Unusual administrative API calls
SIEM Query:
Search for authentication events with JWT tokens containing key 'PanIndex' or admin actions from non-standard sources🔗 References
- https://github.com/px-org/PanIndex/commit/f7ec0c5739af055ad3a825a20294a5c01ada3302
- https://github.com/px-org/PanIndex/releases/tag/v3.1.3
- https://github.com/px-org/PanIndex/security/advisories/GHSA-82wq-gmw8-g87v
- https://github.com/px-org/PanIndex/commit/f7ec0c5739af055ad3a825a20294a5c01ada3302
- https://github.com/px-org/PanIndex/releases/tag/v3.1.3
- https://github.com/px-org/PanIndex/security/advisories/GHSA-82wq-gmw8-g87v
