Missing Authorization in Wukong_HRM Allows Privilege Escalation

Executive Summary

This vulnerability in Wukong_HRM allows any authenticated low-privileged employee to access and modify sensitive data across the entire system. The issue stems from improper authorization checks in EmployeeAspect and EmployeeUtil components, which incorrectly assign HR administrator privileges to all users and return all employee data without validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Wukong_HRM instance allows unauthorized access to sensitive endpoints. Use tools like curl to test endpoints such as POST /hrmEmployee/SocialSecurity/querySalaryList or POST /hrmSalaryArchives/querySalaryArchivesList with low-privileged credentials. If responses include data not belonging to the authenticated user, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read payslips, salary records, bank cards, and personal data of any employee. They could also edit bank cards, delete employees, departments, and contracts company-wide. This could lead to financial fraud, data breaches, and operational disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by exposing personal and sensitive employee data without authorization. It also breaches HIPAA's access controls for protected health information if salary or personal data includes such details. Non-compliance risks include legal penalties, fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Wukong_HRM to a version beyond commit 186115e. Review and restrict access to sensitive endpoints by validating employee IDs against session data. Implement proper role-based access controls in EmployeeAspect and EmployeeUtil to ensure data-scope checks enforce correct permissions.

Useful 0 Not Useful 0