Authenticated User Account Status Manipulation in jshERP

Executive Summary

jshERP through version 3.6 has a missing authorization vulnerability in the POST /user/batchSetStatus endpoint. This flaw allows authenticated low-privilege users to change other users' account status within the same tenant. Attackers can disable non-owner accounts, potentially locking out administrators, or re-enable disabled accounts by sending crafted requests with specific user IDs and status values.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your jshERP instance allows unauthenticated low-privilege users to access the POST /user/batchSetStatus endpoint. Use tools like curl to send test requests with valid session tokens and low-privilege user credentials to see if account status changes are possible. Example: curl -X POST -H 'Cookie: JSESSIONID=your_session' -d 'ids=1,2&status=0' http://target/jshERP-boot/user/batchSetStatus

Review server logs for unauthorized POST requests to /user/batchSetStatus or similar endpoints. Check if the LogCostFilter servlet filter is the only access control mechanism and if it lacks role verification.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service by disabling all non-owner accounts in a tenant, locking out administrators and colleagues. Attackers can also re-enable disabled accounts or create new unauthorized accounts within the tenant, bypassing UI restrictions. The impact is tenant-scoped due to tenant isolation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized account modifications, potentially violating data access and integrity controls required by GDPR and HIPAA. GDPR mandates strict access controls and user consent for data handling, while HIPAA requires role-based access to protect sensitive health information. Unauthorized privilege changes may result in unauthorized data exposure or tampering, compromising compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade jshERP to a version beyond 3.6 where this vulnerability is patched. If upgrading is not possible, restrict access to the /user/batchSetStatus endpoint via network-level controls or WAF rules.

Implement proper role-based authorization checks in the backend, ensuring only admin users can modify account statuses. Review and harden UserController.java and UserService.java to enforce permission validations.

Useful 0 Not Useful 0