Authenticated Role Privilege Escalation in jshERP

Executive Summary

jshERP through version 3.6 has a vulnerability where role management endpoints fail to validate caller permissions. Authenticated users can exploit /role/update and /role/delete to modify any role's data scope or delete roles without proper authorization checks. This allows privilege escalation and access to all business records in the tenant.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privilege users can access or modify role management endpoints like /role/update or /role/delete. Use tools like curl to test these endpoints with different user tokens. Example: curl -X POST http://target/jshERP/role/update -H 'X-Access-Token: user_token' -d 'roleId=1&dataScope=ALL'. If successful without admin checks, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could escalate privileges, change data visibility to all records, and access sensitive business information. This could lead to unauthorized data exposure, data manipulation, or complete system compromise within the tenant.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. Unauthorized access risks data breaches and non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to a patched version beyond 3.6. If an update is not available, restrict access to /role/update and /role/delete endpoints via network-level controls or WAF rules. Ensure all role modification requests validate admin privileges server-side. Review logs for unauthorized role changes.

Useful 0 Not Useful 0