HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

Root

Cause

The NodeJS version of HAXcms, up to version 11.0.6, uses an insecure default configuration intended for local development. The environment variable HAXCMS_DISABLE_JWT_CHECKS is set to true by default, which disables all authentication and authorization checks [1][3]. This design flaw means that if a user deploys haxcms-nodejs without modifying the default settings, the application will not enforce session authentication.

Exploitation

An attacker can exploit this vulnerability simply by accessing the HAXXcms instance over the network. No authentication is required; the application loads without any JWT token verification [3]. This allows any remote, unauthenticated user to interact with the CMS endpoints.

Impact

With JWT checks disabled, an unauthenticated remote attacker can access, modify, and delete all site information, including user data, content, and configuration [3]. This fully compromises the confidentiality, integrity, and availability of the CMS instance.

Mitigation

The vulnerability is fixed in HAXcms NodeJS version 11.0.7 [1]. Users are strongly advised to upgrade immediately. For deployments that cannot upgrade, ensure that HAXCMS_DISABLE_JWT_CHECKS is set to false in the production environment.