Hardcoded Default JWT Secret Enables Token Forgery

yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

Casky was already ahead

This CVE exploits attack patterns that Casky's 215matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Yeti-platform versions before 2.1.12 contain a critical authentication bypass vulnerability stemming from a hardcoded default JWT secret key. When administrators fail to change the YETI_AUTH_SECRET_KEY from its default value of 'SECRET', attackers can forge valid JSON Web Tokens (CWE-798: Use of Hard-Coded Credentials) to impersonate legitimate users and gain unauthorized access to the platform. This vulnerability impacts organizations running vulnerable Yeti versions that haven't implemented proper secret rotation procedures, potentially exposing threat intelligence platforms and their sensitive data to unauthorized access. The attack requires minimal sophistication—an attacker only needs knowledge of the default secret to generate valid authentication tokens.

Casky's 215 mapped skills detect the attack patterns behind this vulnerability through Claude AI's extended reasoning capabilities focused on TA0006 (Credential Access) techniques. Practitioners using Casky would observe detection patterns identifying suspicious JWT token generation attempts, anomalous authentication flows using hardcoded or weak secrets, and lateral movement attempts following initial token forgery. The platform's Claude-powered analysis would surface findings related to authentication bypass indicators, including attempts to use default credentials, unexpected token creation outside normal authentication workflows, and access patterns consistent with forged credentials. Security teams would see correlated alerts highlighting instances where default secret values remain unchanged, combined with behavioral analysis showing token-based access from unusual sources—enabling rapid identification and remediation before attackers can exfiltrate threat intelligence data or compromise the platform's integrity.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

215 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2024-46508.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2024-46508

Casky has 215 skills that investigate the attack patterns behind CVE-2024-46508. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn