ToolJet Default Login Scanner

ToolJet is an open-source low-code tool used for building internal tools. It is widely used by organizations to create custom dashboards, admin panels, and internal applications. Enterprises and businesses leverage ToolJet to expedite development processes without requiring deep technical expertise. Designed to be easily deployable across various environments, it supports integration with numerous databases and third-party services. ToolJet’s flexibility and ease of use make it a popular choice for quick prototyping and operational tools across different sectors. It is designed to be user-friendly, allowing non-developers to build applications with minimal guidance.

The default login vulnerability in ToolJet allows unauthorized access through known default credentials. This can lead to security risks where an attacker might access the ToolJet instance and retrieve sensitive data. The vulnerability arises because some installations retain the default login credentials, which can be easily guessed. This kind of vulnerability is common when security best practices are not followed during initial setup. Proper configuration and change of default credentials are necessary to prevent unauthorized access. A successful exploit of this vulnerability could compromise integrity, confidentiality, and availability of the ToolJet service.

Technical details of this vulnerability include the use of hardcoded usernames and passwords that grant access when not changed post-installation. The susceptible endpoint in this instance is "/api/authenticate", where the authentication process is bypassed using default credentials like "[email protected]" with the password "password". Successful authentication results in the generation of an "auth_token" and "organization_id". The vulnerability is specifically critical when the HTTP status code 201 is returned, as it indicates successful authentication. These details underscore the importance of changing default credentials immediately after setup to secure application access.

If exploited, this vulnerability could lead to unauthorized access to sensitive organizational data and potential data breaches. An attacker could modify, delete, or exfiltrate information, thereby causing reputational and financial damage to the organization. Malicious actors gaining access through default credentials may also exploit other vulnerabilities within the application or network. This could escalate privileges, leading to broader access within the network and increased damage. System integrity could be compromised, causing service disruptions and loss of customer trust.

REFERENCES

• https://docs.tooljet.com/docs/contributing-guide/setup/docker/