Authentication Bypass in Wukong HRM via ParamAspect

Executive Summary

This vulnerability is an authentication bypass in Wukong_HRM through commit 186115e. It exists in the ParamAspect component which is supposed to enforce authentication by checking for a valid AUTH-TOKEN header. However, when this header is omitted, the system fails to block access, allowing unauthenticated attackers to call any HRM API endpoint. This grants attackers HR administrator privileges without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated requests to Wukong_HRM API endpoints return sensitive data. Use tools like curl to send requests without the AUTH-TOKEN header to endpoints like /hrmSalarySlipRecord/querySlipDetail/{id}, /adminFile/download/{fileId}, or /hrmEmployee/export. If responses include sensitive data, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers can gain unauthorized access to sensitive HR data including payslips, salary history, employee personal data, and attachments. They can also modify or delete company-wide HR records. The vulnerability allows complete HR administrator access, enabling full control over employee and company data without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It enables unauthorized access to personally identifiable information (PII) and protected health information (PHI), which are strictly regulated. Organizations using affected Wukong_HRM versions would fail compliance audits and face potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Wukong_HRM to a patched version beyond commit 186115e. Ensure ParamAspect enforces strict token validation for all API endpoints. Block unauthenticated requests to sensitive endpoints and audit access logs for suspicious activity.

Useful 0 Not Useful 0