Authorization Bypass in LAMP-Cloud Exposes User Data

Executive Summary

This vulnerability is an authorization bypass in lamp-cloud through version 5.10.0. It exists in the getUserInfoById endpoint, where authenticated users can access other users' full profiles by manipulating the userId parameter. This allows attackers to read sensitive information such as mobile numbers, email addresses, national identity card numbers, and social media OpenIDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API endpoints for unauthorized access to user profiles. Check logs for repeated requests to the getUserInfoById endpoint with varying userId parameters. Use tools like curl to test the endpoint manually: curl -X GET 'http://target/lamp-cloud/api/getUserInfoById?userId=1' and observe if non-admin users can access other users' data.

Useful 0 Not Useful 0

Impact Analysis

If you use lamp-cloud versions up to 5.10.0, an attacker with valid credentials could exploit this flaw to steal personal data of other users. This could lead to privacy breaches, identity theft, or targeted phishing attacks using harvested contact details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to implement proper access controls. It may also conflict with HIPAA if protected health information is exposed. Organizations using this software could face regulatory penalties for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update lamp-cloud to the latest version beyond 5.10.0. Implement strict access controls to ensure only authorized users can access user profile endpoints. Add input validation to restrict userId parameters to the requesting user's own ID. Review logs for past unauthorized access and notify affected users if sensitive data was exposed.

Useful 0 Not Useful 0