Executive brief
Flood is a Node.js application for managing torrent downloads. The application's JWT signing secret was accidentally included in compiled static assets served to all clients, allowing attackers to forge authentication tokens and bypass login requirements. Combined with Flood's access to rTorrent's unprotected SCGI interface, this enables complete application compromise and arbitrary code execution.
Technical details
The vulnerability is a sensitive information disclosure leading to authentication bypass. During a refactor (commit 8d11640b), config.js containing the server's JWT signing secret was imported into client-side (frontend) components to access the disableUsersAndAuth configuration flag. When compiled into static assets, the entire config.js—including the secret value—was shipped to all clients. An attacker can retrieve the secret from any static asset response and use it to sign valid JWT authentication tokens, completely bypassing Flood's builtin access control. The attack requires no authentication, user interaction, or special network position (CVSS:3.1 AV:N/AC:L/PR:N/UI:N). Patches were released in commits 042cb4ce (removed config.js imports from frontend) and 103f53c8 (added runtime checks to prevent secrets in static assets).
Affected products
- Flood Flood 2.0.0 to before 3.0.0 (commit 8d11640b to before 042cb4ce)
Timeline
- 2020-08-26: disclosed
- 2020-08-24: patched: Patches released in commits 042cb4ce and 103f53c8