Summary
StarTraining contains a hard-coded password in the JWT token handling path used by UserLoginService.createToken. A remote attacker who can reach the affected login functionality may manipulate user_id or company_id values to trigger use of the embedded credential, potentially enabling unauthorized authentication or token creation.
Affected context
The issue occurs in StarTraining deployments up to version 3.8.1 where the JWT Token Handler uses the UserLoginService.createToken function and related configuration in application.yml. Risk is present when externally influenced user_id or company_id values reach this token-generation logic and the application accepts a hard-coded credential as part of authentication or token creation.
Exploit preconditions
- Attack surface: Remotely reachable authentication or token-generation functionality
- Required access: Network access to the affected application endpoint; valid credentials may not be required if the vulnerable path is exposed before authentication
- Trigger point: Processing attacker-influenced
user_idorcompany_idarguments inUserLoginService.createToken - Why exploitation is possible: A fixed credential is available to application logic and may be selected based on manipulated input, weakening normal authentication and authorization controls
Why this happens
The underlying flaw is the inclusion or use of a fixed password within authentication-related application logic or configuration. Hard-coded credentials can be recovered, reused, or indirectly selected through attacker-controlled input rather than being verified through a secure credential-management process. This maps primarily to CWE-259: Use of Hard-coded Password, with a related relationship to CWE-255: Credentials Management Errors.
Potential impact
- An attacker may create or obtain JWT tokens without satisfying intended authentication requirements
- Unauthorized users could access protected application functions or data
- Compromised tokens could enable impersonation of users or organizations
- The application may experience privilege escalation or account compromise
- Downstream systems could trust forged or improperly issued tokens
General mitigation guidance
Mitigation generally focuses on removing fixed credentials from source code and runtime configuration, and ensuring token issuance depends on independently verified identity and authorization data.
Common defensive patterns include:
- Replacing hard-coded passwords with securely managed, rotatable secrets or short-lived credentials
- Avoiding credential selection based on directly supplied identifiers
- Validating and authorizing
user_idandcompany_idagainst trusted server-side records - Applying strict JWT signing-key protection, key rotation, expiration, audience, and issuer validation
- Enforcing least privilege for service identities and separating organization-level permissions
- Preventing sensitive secrets from appearing in source repositories, logs, or default configuration files
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis patterns identifying password literals, embedded secrets, or credential-like values in application code and YAML files
- Code review checks for authentication branches that select credentials from user-controlled identifiers
- Secret-scanning policies across repositories, container images, deployment manifests, and configuration stores
- Tests that verify token creation fails when identity and authorization data do not match trusted records
- Runtime monitoring for unusual token issuance, repeated identifier manipulation, and authentication anomalies
Automated security review tools may help identify hard-coded secrets and unsafe authentication flows, but findings should be validated against deployment-specific behavior.
