Authenticated Information Exposure in jshERP via Unredacted Password Hashes

Executive Summary

jshERP through version 3.6 has a vulnerability where the /user/info endpoint fails to redact password hashes. Authenticated users can retrieve unsalted MD5 password digests for any user by supplying user IDs. This allows attackers to obtain hashes for offline cracking or direct authentication bypass.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /user/info endpoint exposes unsalted MD5 password hashes for any user. Use a valid authenticated session token to send a GET request to /user/info with a user ID parameter. If the response contains an MD5 hash without salt, the system is vulnerable.

• Example command using curl: curl -X GET 'http://target.com/user/info?userId=1' -H 'X-Access-Token: YOUR_TOKEN'

Useful 0 Not Useful 0

Impact Analysis

If you use jshERP versions up to 3.6, an attacker with low-privilege access could steal password hashes for all users, including administrators. These hashes can be cracked offline or used directly to bypass authentication, potentially leading to full system compromise or unauthorized access to sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. GDPR requires protecting personal data, including passwords, while HIPAA mandates safeguarding sensitive health information. The exposure of unsalted password hashes could result in non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to a version that patches this vulnerability. If an update is unavailable, restrict access to the /user/info endpoint to authorized users only and implement proper authorization checks to prevent unauthorized access to sensitive data.

Useful 0 Not Useful 0