Authentication Bypass in ZongXR SuperMarket 1.0.0.0

Executive Summary

This vulnerability is a missing authentication flaw in ZongXR SuperMarket 1.0.0.0. The OrderController.deleteOrder function in order/src/main/java/com/supermarket/order/controller/OrderController.java allows remote attackers to delete orders by manipulating the orderId parameter without authentication. The attack is possible because the endpoint does not verify user identity or ownership of the order before deletion.

Useful 0 Not Useful 0

Detection Guidance

Check if the GET /order/manage/delete/{orderId} endpoint is accessible without authentication. Use tools like curl to send requests to this endpoint with arbitrary orderId values and verify if orders can be deleted without valid session tokens or user identity checks.

Useful 0 Not Useful 0

Impact Analysis

If you use ZongXR SuperMarket 1.0.0.0, an attacker could delete your orders remotely by knowing their IDs. This could lead to loss of order data, financial discrepancies, or disruption of service. The exploit is public, increasing the risk of attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR's data integrity and availability principles by allowing unauthorized deletion of order data. For HIPAA, it may compromise protected health information if orders contain such data. Compliance requires ensuring data integrity and access controls, which this flaw undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /order/** path in the gateway configuration to enforce authentication. Update the OrderController.deleteOrder function to validate user session and ownership before processing order deletion requests.

Useful 0 Not Useful 0