Missing Authorization in Youlai-Boot Allows Privilege Escalation

Executive Summary

This vulnerability is a missing authorization flaw in youlai-boot through version 2.21.1. It allows authenticated users to assign arbitrary menu and button permissions to roles via the PUT /api/v1/roles/{roleId}/menus endpoint. Low-privileged users, such as the GUEST test account, can grant themselves all permissions, refresh the Redis permission cache, and escalate privileges to administrator-equivalent access.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PUT requests to /api/v1/roles/{roleId}/menus by monitoring web server logs for suspicious activity. Use tools like curl to test the endpoint manually: curl -X PUT -H 'Authorization: Bearer <token>' http://<target>/api/v1/roles/1/menus -d '{"menuIds":[1,2,3]}'. Verify if low-privileged users can assign admin permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with even low-level access could exploit this to gain full administrative privileges. This means they could take control of the system, modify or delete data, and perform unauthorized actions. The impact includes complete system compromise and potential data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using this software may face compliance violations, legal penalties, and reputational damage due to insufficient access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest patches from the youlai-boot repository to add missing @PreAuthorize annotations on sensitive endpoints. Restrict access to the PUT /api/v1/roles/{roleId}/menus endpoint by implementing proper authorization checks. Review and revoke any unauthorized role assignments made during exploitation.

Useful 0 Not Useful 0