Authenticated Role Permission Modification in jshERP

Executive Summary

This vulnerability in jshERP through version 3.6 is a missing authorization check on the POST /userBusiness/updateBtnStr endpoint. It allows authenticated users to modify role button-permission definitions without proper privilege validation. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the POST /userBusiness/updateBtnStr endpoint is accessible to low-privilege users. Use a tool like curl to send a test request with an authenticated X-Access-Token to see if role permissions can be modified without proper authorization. Example: curl -X POST -H 'X-Access-Token: YOUR_TOKEN' -d 'roleId=1&btnStr=test' http://TARGET/jshERP/userBusiness/updateBtnStr

A proof-of-concept script is available at https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-06-userbusiness-btnstr-tamper.py which can automate detection by listing roles and checking if their btn_str can be overwritten.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could escalate their permissions by modifying button-permission strings for higher roles. This could allow unauthorized access to sensitive functions or data within the application. The impact includes potential data breaches, privilege escalation, and unauthorized system modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls, leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to the latest version beyond 3.6 where this vulnerability is patched. If an update is not available, restrict access to the /userBusiness/updateBtnStr endpoint by implementing proper authorization checks to ensure only privileged users can modify role permissions.

Useful 0 Not Useful 0