Description

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T14:17:20.400Z",
  "pubdate": "2026-09-14T14:17:20.400Z",
  "executiveSummary": "The novel-plus application, specifically through version 5.3.3, contains a critical security flaw involving an insecure default password within its cache management functionality. This vulnerability resides in the CacheController.refreshCache endpoint, which is improperly secured against unauthorized access.\nBy utilizing a hardcoded default credential, unauthenticated remote attackers can invoke the cache-refresh mechanism. The primary impact of this vulnerability is the forced invalidation of the application's cache, which degrades system performance by necessitating a high volume of redundant database queries to restore state. This exposes the underlying database infrastructure to potential resource exhaustion and denial-of-service conditions. No authentication or elevated privileges are required to initiate this attack, making it trivial for an external actor to disrupt service availability.",
  "technicalDetails": "The vulnerability is located within the CacheController.refreshCache function of the novel-plus framework. The root cause is the implementation of a static, hardcoded administrative password used to authorize cache refresh operations. Because this credential is static across all installations, it functions as a publicly known secret that can be exploited by any party aware of the endpoint structure.\nThe exploitation process is straightforward: an attacker identifies the cache/refresh endpoint and appends the hardcoded password as a parameter in the URL path. Upon receipt of the request, the CacheController validates the input against the hardcoded string. Upon successful 'authentication,' the controller proceeds to clear the current application cache. This bypasses any legitimate access control lists or authentication middleware that might otherwise protect administrative-level functions.\nAffected versions include all iterations of novel-plus up to and including 5.3.3. The attack is executable over the network via standard HTTP/HTTPS protocols without any prerequisite session data. There are no requirements for administrative or user privileges, as the system treats the inclusion of the default credential as sufficient authorization.\nThe attack flow is as follows: 1) The attacker crafts an HTTP GET or POST request targeting the endpoint defined by the CacheController.refreshCache mapping. 2) The attacker injects the hardcoded default password into the request path. 3) The backend application validates the credential, identifying it as authorized due to the flawed hardcoding. 4) The application invalidates the cache entries. 5) Subsequent user requests hitting the application trigger synchronous database queries to repopulate the cache, as the previous entries have been discarded. The primary post-exploitation impact is a significant increase in latency and database load, which, if sustained, leads to a denial-of-service state for legitimate users relying on the cached data."
}