{"id":43337,"date":"2025-05-23T20:21:53","date_gmt":"2025-05-23T20:21:53","guid":{"rendered":""},"modified":"2025-10-22T19:05:12","modified_gmt":"2025-10-23T01:05:12","slug":"cve-2025-47945-critical-vulnerability-in-donetick-task-management-application-allows-full-account-takeover","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-47945-critical-vulnerability-in-donetick-task-management-application-allows-full-account-takeover\/","title":{"rendered":"CVE-2025-47945: Critical Vulnerability in Donetick Task Management Application Allows Full Account Takeover<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability, labeled CVE-2025-47945, in the Donetick open-source application used for managing tasks and chores. This vulnerability can lead to a full user account takeover, potentially compromising system security and leading to data leakage. Given the widespread usage of Donetick, this vulnerability presents a significant risk to system administrators and users<\/a> alike, necessitating immediate attention and mitigation.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-47945
\nSeverity: Critical (CVSS score 9.1)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Full account takeover, potential system<\/a> compromise, and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Donetick | Prior to version<\/a> 0.1.44<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability arises from the application’s use of JSON Web<\/a> Tokens (JWT) for user authentication. In versions of the application prior to 0.1.44, the JWT signing secret<\/a> has a weak default value. The onus is on the system administrator to change this value to something more secure<\/a>. However, this approach is inadequate and has led to the vulnerability being present in the live version<\/a> of the app. If an attacker can predict or brute force the JWT signing key, they can generate valid JWTs and impersonate any user of the application, leading to a potential full account takeover<\/a>.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how an attacker might exploit this vulnerability<\/a>:<\/p>\n

POST \/user\/login HTTP\/1.1\nHost: vulnerable-donetick.com\nContent-Type: application\/json\n{ \"username\": \"victim\", \"jwt\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\" }<\/code><\/pre>\n
In this example, the attacker sends a POST request to the login endpoint of the vulnerable<\/a> Donetick application. The attacker supplies a malicious JWT (in this case, a JWT they have generated using the weak default signing<\/a> secret) in place of a legitimate JWT, allowing them to impersonate the victim.<\/p>\n
Mitigation and Conclusion<\/strong><\/p>\n
The vulnerability has been addressed in version<\/a> 0.1.44 of Donetick, and it is strongly recommended that users update to this version as soon as possible. As a temporary mitigation, Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS) can be used to monitor and block malicious traffic. However, these measures should not replace the need for patching and updating the application. By staying current with updates and adopting strong cybersecurity<\/a> practices, users can significantly reduce the risk posed by vulnerabilities such as CVE-2025-47945.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability, labeled CVE-2025-47945, in the Donetick open-source application used for managing tasks and chores. This vulnerability can lead to a full user account takeover, potentially compromising system security and leading to data leakage. Given the widespread usage of Donetick, this vulnerability presents […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-43337","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t