Authorization Bypass in jshERP Leading to Password Reset

Executive Summary

jshERP through version 3.6 has an authorization bypass vulnerability in the password reset feature. Authenticated users can reset passwords for any other user by submitting a request with an arbitrary user ID. This allows attackers to set a known default password for targeted accounts, including administrators, enabling unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your jshERP instance has the POST /user/resetPwd endpoint exposed. Use tools like curl to send a test request with an arbitrary user ID to see if password reset is possible without proper authorization. Example: curl -X POST http://target/jshERP-boot/user/resetPwd -H 'Content-Type: application/json' -d '{"userId": 1}'

Alternatively, use the provided PoC script from Resource 3 to test for the vulnerability. Run it with enumeration mode first to list users, then attempt a password reset to confirm the flaw.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to any user account, including administrators, by resetting passwords to a known value. This could lead to data theft, privilege escalation, or full system compromise depending on the account accessed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected jshERP versions may face compliance violations, data breach notifications, and potential fines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to the latest version beyond 3.6. If an update is not available, apply a patch to enforce authorization checks in the POST /user/resetPwd endpoint to ensure only the targeted user can reset their own password.

Temporarily disable the password reset functionality if not essential. Review all user accounts for unauthorized password changes and reset passwords for any potentially compromised accounts.

Monitor network traffic for suspicious requests to the /user/resetPwd endpoint and implement rate limiting to prevent brute force attacks.

Useful 0 Not Useful 0