Description

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T02:17:21.067Z",
  "pubdate": "2026-09-07T02:17:21.067Z",
  "executiveSummary": "A critical security vulnerability exists in FeehiCMS up to version 2.1.1, stemming from the implementation of a hard-coded cryptographic key within the cookie validation mechanism. This flaw resides in the 'environments/prod/backend/config/main-local.php' file, where the 'cookieValidationKey' is defined as a static, predictable string.\nThis vulnerability allows an unauthenticated, remote attacker to compromise the integrity and confidentiality of session data. By leveraging the known hard-coded key, an attacker can forge cryptographically signed session cookies, effectively bypassing authentication mechanisms. This leads to potential remote code execution or full unauthorized administrative access to the affected system.\nGiven that the exploit is publicly available and the vendor has not provided a response or patch, the risk to exposed instances is critical. Organizations utilizing FeehiCMS are urged to implement immediate compensating controls to mitigate the potential for unauthorized system access.",
  "technicalDetails": "The vulnerability is rooted in the insecure configuration of the Yii framework's cookie validation component within FeehiCMS. Specifically, the configuration file 'environments/prod/backend/config/main-local.php' utilizes a hard-coded, static 'cookieValidationKey'. In the Yii framework, this key is the primary secret used to sign cookies, ensuring that the data stored within them has not been tampered with by the client.\nWhen a hard-coded key is employed, the cryptographic signature of the cookie becomes deterministic and predictable. Because the key is publicly discoverable—either through source code analysis or by downloading the project package—an attacker can replicate the signing process. The attack flow begins with the adversary intercepting a legitimate session or constructing a malicious payload targeting the application's session structure.\nBy utilizing the recovered 'cookieValidationKey', an attacker can generate arbitrary serialized session data and sign it using the framework's internal cookie validation logic. The resulting cookie, when presented to the application, will be validated as legitimate by the server because it correctly matches the signature derived from the known static key. This allows the attacker to impersonate any user, including high-privileged administrative accounts, without requiring valid credentials.\nThe exploitation is feasible remotely and requires no prior authentication. The post-exploitation impact is severe, as session hijacking often facilitates access to backend administrative panels. In scenarios where the application is configured to perform deserialization on session data or where administrative actions grant configuration modification capabilities, this vulnerability serves as a direct vector for achieving remote code execution (RCE) on the underlying server. Because this key is hard-coded in the deployment configuration, all installations using the default distribution remain inherently vulnerable until the secret is rotated to a cryptographically secure, unique, and environment-specific string."
}