Improper Authorization in SmartAdmin API Java17 SpringBoot3

Executive Summary

This vulnerability is an improper authorization issue in SmartAdmin API Java17 SpringBoot3 version 3.30.0. The /employee/queryAll endpoint fails to enforce proper function-level permissions and data-scope authorization. This allows a low-privileged authenticated employee to access employee records from other departments and users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the GET /employee/queryAll?disabledFlag=false endpoint is accessible without proper authorization. Use tools like curl to send requests with low-privileged employee credentials and verify if unauthorized employee records are returned. Example: curl -X GET 'http://target-server/employee/queryAll?disabledFlag=false' -H 'Authorization: Bearer low_privileged_token'

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this to view sensitive employee data across departments, leading to privacy breaches, unauthorized data exposure, and potential misuse of confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by enabling unauthorized access to personal and health-related employee data. It compromises data confidentiality and could result in regulatory penalties for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /employee/queryAll endpoint by implementing proper function-level permission checks and data-scope authorization. Review all employee records accessed through this endpoint for unauthorized data exposure.

Useful 0 Not Useful 0