CVE-2021-40903

Vulnerability

Antminer Monitor version 0.50.0 contains a hardcoded Flask secret key in the settings.py configuration file. Instead of using a randomly generated secret, the developer left the static string 'super secret key' in the production build. This flaw exists in the Flask server's session signing mechanism, which is used to authenticate user sessions. The vulnerable code path is reachable by any user who can access the web interface, requiring no special configuration to trigger. The affected version is 0.50.0 as described in the references [1] [3].

Exploitation

An attacker needs only network access to the Antminer Monitor web interface. No authentication is required initially. The attacker uses the Flask session signing tool flask-unsign to forge a valid session cookie by signing it with the known secret key. The exploit generates a cookie that sets _user_id to '1' (admin). This forged session cookie is then presented to the web server in the session field, granting the attacker admin-level access without valid credentials. The steps are demonstrated in the exploit published on Exploit-DB and Packet Storm [1] [3].

Impact

Successful exploitation results in authentication bypass, granting the attacker full administrative privileges on the Antminer Monitor web interface. With admin access, the attacker can view and modify all monitored miners, including configuration data, hashrate, temperatures, and other sensitive system information. The impact is a complete compromise of confidentiality (information disclosure) and integrity (potential unauthorized configuration changes). The attacker gains the highest privilege level available in the application, effectively controlling the monitoring dashboard and the connected miner fleet.

Mitigation

As of the available references, no patched version has been released [1] [3]. The developer must regenerate the Flask secret key randomly for each deployment and ensure that settings.py does not contain hardcoded secrets. Users are advised to update the secret key themselves after installation by modifying the SECRET_KEY variable in settings.py to a long, random value and restarting the Flask server. Until a vendor fix arrives, all installations running version 0.50.0 remain vulnerable. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.