Skip to content

Hexo Admin Token

Service Name: Hexo

Service Description: Hexo is a fast, simple, and powerful blog framework. It uses Node.js to transform markdown files into static websites. Hexo Admin is a plugin that provides a web-based admin interface for managing Hexo blog content.

Service Address: https://hexo.io/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants administrative access to manage blog content through the Hexo Admin interface, including creating, editing, and deleting posts, pages, and other content.

Secret Revokement URL: Does not exist (requires manual configuration file update)

Secret Example: hexo-admin-token:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Suspicious Activity Investigation Instructions:

  • Check server logs for unauthorized access to the Hexo Admin interface
  • Review commit history in your repository for unexpected changes to content
  • Examine file modification timestamps for any content that may have been altered
  • Monitor for unexpected published posts or content changes on your site
  • Check for any new user accounts that may have been created

Mitigation Instructions:

  • Generate a new admin token by updating the _config.yml file in your Hexo project

  • Add the new token to the admin section: admin: { username: your_username,

password_hash: new_hash, secret: new_token }

  • Restart your Hexo server to apply the changes
  • Update any deployment configurations that might contain the old token
  • Consider implementing additional security measures like IP restrictions at the

web server level

  • Enable two-factor authentication if supported by your hosting environment
  • Review and update all access credentials for connected services