Privilege Escalation in jshERP via Role Assignment

Executive Summary

jshERP 3.6 has a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint. Authenticated users can exploit this to grant themselves arbitrary roles by sending a POST request with type=UserRole, their user ID, and a role ID list. This allows low-privilege users to escalate to tenant administrator.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to the /userBusiness/updateOneValueByKeyIdAndType endpoint. Check for requests with type=UserRole, user ID manipulation, or role ID list modifications. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP traffic for suspicious patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker with basic user access could escalate privileges to administrator, gaining control over sensitive data, financial functions, and system management. This could lead to data theft, unauthorized modifications, or system disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, undermining data integrity and confidentiality controls required by GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to a patched version if available. Restrict access to the /userBusiness/updateOneValueByKeyIdAndType endpoint via firewall rules. Review user roles and permissions for unauthorized changes. Implement strict input validation and authorization checks on all endpoints.

Useful 0 Not Useful 0