3. Vulnerability Location

• powerjob-server-auth/.../jwt/impl/DefaultSecretProvider.java:31-45: return md5(environment.getProperty("spring.datasource.core.jdbc-url"));
• powerjob-server-auth/.../jwt/impl/JwtServiceImpl.java:44-102: hardcoded BASE_SECURITY constant; genSecretKey(secret) = Decoders.BASE64.decode(BASE_SECURITY.concat(secret)) → Keys.hmacShaKeyFor
• The key shares the repository/database with business data; the JDBC URL is plaintext in config/docker-compose.

4. Root Cause

• A predictable / derivable key is used instead of a random, persisted one: the key depends only on a public constant + the MD5 of the public default URL.
• The JWT payload (username/encryptedToken) has a secondary check for PWJB accounts (DigestUtils.rePassword(password, username)), but:
  • under the default password this value is computable offline → full admin takeover;
  • the OpenAPI App Token (claims appId/password/encryptType) can be forged directly to bypass authentication (OpenApiSecurityServiceImpl:87-105);
  • other third-party login accounts may have no secondary check.

5. Reproduction (verified — complete end-to-end)

Environment: local PowerJob server (127.0.0.1:7700, JDBC URL jdbc:mysql://127.0.0.1:3307/powerjob_daily?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowMultiQueries=true). The attacker derives everything offline from public information only:

Actual result (forged token passes authentication):

→ the forged token authenticates as admin and returns real data (baseline is rejected with UserNotLoggedIn).

Key points:

• The offline-derived encryptedToken matches the DB-stored value byte-for-byte (ADMIN_b82a450701f6a71723fb99931fe35e18_b).
• The key is determined entirely by the public constant BASE_SECURITY + MD5 of the public default JDBC URL → derivable offline with no credentials.
• The PWJB encryptedToken is recomputable offline with the default password (powerjob_admin, finding PJ-02) → full admin takeover.
• If the admin changed the password, forging a web token is blocked by the encryptedToken mismatch, but the OpenAPI App Token path (claims appId/password/encryptType, OpenApiSecurityServiceImpl:87-105) can still be forged independently to bypass OpenAPI authentication.

Even if the default password is changed, the vulnerability persists through other attack vectors:

• An attacker who obtains any valid user's encryptedToken via other means (e.g., SQL injection, database backup exposure, log leakage, or information disclosure from other endpoints) can combine that token with the predictable signing key to forge a JWT for that specific user.
• This bypasses the encryptedToken mismatch issue entirely, because the forged token now contains a legitimate encryptedToken derived from the actual database record.
• As a result, the attacker does not need to know the user's plaintext password at all, and the forged JWT remains valid even after the user changes their password (until the token expires).

PoC: powerjob_jwt_key.py 192.168.49.128:7700

6. Impact

• Authentication bypass / arbitrary-user token forgery → web console / OpenAPI administration surfaces.

7. Suggested Fix

• Generate the key randomly and persist it (file/environment), never derive it from the JDBC URL or a constant.
• Use a separate key for OpenAPI App Tokens vs. web JWTs.
• Enforce the encryptedToken secondary check for all accounts.

8. CWE / CVSS

• CWE: CWE-321 (Use of Hard-coded Cryptographic Key) / CWE-798
• CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 Critical (combined with the default password / OpenAPI)