CVE-2019-15075: Use of Hard-coded Credentials (CWE-798)
value: An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 7.5
Published: 2020-03-20T18:15Z
Repository: https://github.com/iNextrix/ASTPP
Language: PHP
Files changed: config/astpp-config.conf, install.sh, web_interface/astpp/application/config/config.php
Commit date: 2019-07-12 16:55:07 +0530
Commit message: [IMP] Generating random strong keys

Diff: diff --git a/config/astpp-config.conf b/config/astpp-config.conf
index e5428f7..c53701a 100755
--- a/config/astpp-config.conf
+++ b/config/astpp-config.conf
@@ -1,11 +1,12 @@
 ; ASTPP Database Connection Information
 dbhost = 127.0.0.1
 dbname = astpp
 dbuser = astppuser
 dbpass = <PASSSWORD>
-
+PRIVATE_KEY = <PR_KEY>
+ENCRYPTION_KEY = <EN_KEY>
 
 ; Database type:  ASTPP was designed for a MySQL database initially.  Valid options are:
 ; MySQL. Pgsql is coming but is not ready yet.
 astpp_dbengine = MySQLi
 
diff --git a/install.sh b/install.sh
index a59bbcf..858abae 100644
--- a/install.sh
+++ b/install.sh
@@ -68,10 +68,12 @@ genpasswd()
 	echo $password
 }
 
 MYSQL_ROOT_PASSWORD=`echo "$(genpasswd 20)" | sed s/./*/5`
 ASTPPUSER_MYSQL_PASSWORD=`echo "$(genpasswd 20)" | sed s/./*/5`
+PR_KEY=`echo "$(genpasswd 32)"`
+EN_KEY=`echo "$(genpasswd 12)"`
 #Fetch OS Distribution
 get_linux_distribution ()
 { 
         V1=`cat /etc/*release | head -n1 | tail -n1 | cut -c 14- | cut -c1-18`
         V2=`cat /etc/*release | head -n7 | tail -n1 | cut -c 14- | cut -c1-14`
@@ -330,10 +332,12 @@ normalize_astpp ()
         chmod 777 /var/log/astpp/astpp.log
         sed -i "s#dbpass = <PASSSWORD>#dbpass = ${ASTPPUSER_MYSQL_PASSWORD}#g" ${ASTPPDIR}astpp-config.conf
         sed -i "s#DB_PASSWD=\"<PASSSWORD>\"#DB_PASSWD = \"${ASTPPUSER_MYSQL_PASSWORD}\"#g" ${ASTPPDIR}astpp.lua
         sed -i "s#base_url=http://localhost:8089/#base_url=https://${ASTPP_HOST_DOMAIN_NAME}/#g" ${ASTPPDIR}/astpp-config.conf
         sed -i "s#PASSWORD = <PASSWORD>#PASSWORD = ${ASTPPUSER_MYSQL_PASSWORD}#g" /etc/odbc.ini
+        sed -i "s#<PR_KEY>#${PR_KEY}#g" ${ASTPPDIR}astpp-config.conf
+        sed -i "s#<EN_KEY>#${EN_KEY}#g" ${ASTPPDIR}astpp-config.conf
         systemctl restart nginx
 }
 
 #Install freeswitch with dependencies
 install_freeswitch ()
diff --git a/web_interface/astpp/application/config/config.php b/web_interface/astpp/application/config/config.php
index 07ac130..222e42c 100755
--- a/web_interface/astpp/application/config/config.php
+++ b/web_interface/astpp/application/config/config.php
@@ -226,22 +226,21 @@ $config ['cache_path'] = '';
  * |
  * | ASTPP Using private key for encryption/decryption of password.
  * | MUST set private key with 32 characters.
  * |
  */
-$config ['private_key'] = '8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR';
+$config ['private_key'] = $astpp_config ['PRIVATE_KEY'];
 /*
  * |--------------------------------------------------------------------------
  * | Encryption Key
  * |--------------------------------------------------------------------------
  * |
  * | If you use the Encryption class or the Session class you
  * | MUST set an encryption key. See the user guide for info.
  * |
  */
-$config ['encryption_key'] = 'r)fddEw232f';
-
+$config ['encryption_key'] = $astpp_config ['ENCRYPTION_KEY'];
 /*
  * |--------------------------------------------------------------------------
  * | Session Variables
  * |------------------------------------------------------k--------------------
  * |

Vulnerable code: 
$config ['private_key'] = '8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR';
$config ['encryption_key'] = 'r)fddEw232f';

Fixed code: PRIVATE_KEY = <PR_KEY>
ENCRYPTION_KEY = <EN_KEY>
PR_KEY=`echo "$(genpasswd 32)"`
EN_KEY=`echo "$(genpasswd 12)"`
        sed -i "s#<PR_KEY>#${PR_KEY}#g" ${ASTPPDIR}astpp-config.conf
        sed -i "s#<EN_KEY>#${EN_KEY}#g" ${ASTPPDIR}astpp-config.conf
$config ['private_key'] = $astpp_config ['PRIVATE_KEY'];
$config ['encryption_key'] = $astpp_config ['ENCRYPTION_KEY'];