Authentication Bypass in Jpom Leading to RCE

Executive Summary

This vulnerability is an authentication bypass in Jpom versions 2.10.0 through 2.11.12 that allows unauthenticated attackers to gain super-administrator access. The flaw occurs because the JPOM-USER-TOKEN header is not properly validated. Attackers can inject query conditions like 'is not null' into this header, which Hutool's Condition parser interprets as an operator. This bypasses authentication and enables command execution through Jpom's script features.

Useful 0 Not Useful 0

Detection Guidance

Check Jpom server versions between 2.10.0 and 2.11.12. Inspect HTTP headers for requests containing 'JPOM-USER-TOKEN' with values like 'is not null'. Monitor for unauthorized administrative access or unexpected command execution.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrative control over a Jpom instance without credentials. This allows them to execute arbitrary commands as the Jpom process user, which runs as root in the official image. They could then manipulate deployments, access sensitive data, or take over the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict authentication and authorization controls to protect personal data. HIPAA mandates secure access to protected health information. Exploitation could lead to unauthorized access, data breaches, or loss of audit trails, resulting in non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Jpom to a patched version beyond 2.11.12. Implement strict input validation for the JPOM-USER-TOKEN header. Disable or restrict access to script execution features until patched.

Useful 0 Not Useful 0