AJ-Report Hard-Coded JWT Secret Remote Code Execution Vulnerability

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. By minting a token with reportCode 'dataSet', an attacker can access the testTransform endpoint.

The endpoint passes scripts to GroovyClassLoader, resulting in unauthenticated remote code execution.

• Affected versions: 1.7.1 and earlier
• Requires no authentication
• Results in remote code execution via GroovyClassLoader