CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

Summary

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.

Remediation

1. Inventory every PAICNI CFNext deployment, including staging.
2. Upgrade PAICNI CFNext to 3.1.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7
• Advisoryhttps://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid
• Referencehttps://github.com/PAICNI/CFNext/issues/57
• Referencehttps://github.com/PAICNI/CFNext
• Referencehttps://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12
• Referencehttps://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440