[Security] Fix 5 vulnerabilities: Hardcoded JWT Secret, DB Credentials, Mass Assignment, IDOR, Password in URL (CWE-798, CWE-915, CWE-639, CWE-598)

[saaa99999999]

Security Audit Report — node-jwt

Manual code audit discovered 5 security vulnerabilities (3 Critical, 2 High).

---

CRITICAL-1: CWE-798 Hardcoded JWT Secret (CVSS 9.8)

Location: config/env/development.js:10, config/env/production.js:10, config/env/test.js:10

Data Flow:
config/env/production.js:10 jwtSecret: '$eCrEt'
-> config/env/index.js:2 -> config/routes/user.js:8 -> express-jwt verification

Impact: The JWT secret '$eCrEt' is hardcoded identically in ALL environments. Anyone with repository access can forge valid JWTs for any user.

PoC:

const jwt = require('jsonwebtoken');
const forged = jwt.sign({ id: 1 }, '$eCrEt', { expiresIn: '2 hours' });
// Authorization: Bearer <forged> -> impersonate user id=1

---

CRITICAL-2: CWE-798 Hardcoded DB Root Credentials (CVSS 9.8)

Location: config/env/production.js:5-7

MySQL root/root credentials hardcoded in production config.

---

CRITICAL-3: CWE-915 Mass Assignment (CVSS 9.1)

Location: api/controllers/UserController.js:32

req.dbUser.update(req.body) with NO field whitelist. Attackers can overwrite password, refresh_token, or any user field.

PoC:

PUT /users/1
Authorization: Bearer <any_valid_jwt>
{"password": "evil", "refresh_token": "hijacked"}

---

HIGH-4: CWE-639 IDOR — No Ownership Check (CVSS 8.1)

GET/PUT/DELETE /users/:userId requires only a valid JWT but never checks if the requesting user owns the target account.

HIGH-5: CWE-598 Passwords in URL Query String (CVSS 7.5)

Passwords read from req.query (URL query string) instead of req.body, exposing them in server/proxy/CDN logs.

CVE Request

Advisory: GHSA-cxfg-wv83-vgqg
CVE ID pending — GitHub CNA review (1-5 business days).

---