Executive brief
novel-plus is a novel (e-book) CMS system that manages content caching to improve portal performance. An attacker can invalidate application caches by accessing the cache refresh endpoint with a hardcoded default password, forcing the application to perform unnecessary database queries and potentially degrading service availability for legitimate users.
Technical details
The CacheController.refreshCache endpoint accepts a password parameter in the URL path and compares it against a configurable cache manager password. However, the default configuration contains a hardcoded weak password value that is widely known or easily guessable. An unauthenticated attacker can supply this default password in the endpoint URL (cache/refresh/{password}/{type}) to trigger cache invalidation for homepage recommendations, news, or friend links. This forces the application to repopulate caches from the database on subsequent requests, increasing database load and potentially causing service degradation. There is no authentication or rate limiting protecting this endpoint.
Affected products
- 201206030 novel-plus through 5.3.3
Timeline
- 2026-09-14: disclosed