Authentication Bypass in jshERP LogController

Executive Summary

This vulnerability in jshERP through version 3.6 is a missing authorization flaw in the LogController. It allows any authenticated user, even low-privilege ones, to forge, modify, or delete audit log entries. Attackers can call endpoints like /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, alter user and IP fields, or permanently erase records to hide their activities.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to log endpoints by monitoring HTTP requests to /log/add, /log/update, /log/delete, and /log/deleteBatch. Use tools like curl to test these endpoints with authenticated requests and verify if low-privilege users can modify logs. Example: curl -X POST http://<target>/log/add -H 'Authorization: Bearer <token>' -d 'user_id=attacker&client_ip=malicious'

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate audit logs to cover up malicious actions, making it appear as if unauthorized activities were performed by legitimate users. This could lead to undetected breaches, false attribution of actions, or loss of critical audit trail data needed for investigations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines compliance by allowing unauthorized alteration or deletion of audit logs. GDPR requires accurate and tamper-proof logging for data protection, while HIPAA mandates secure audit trails for healthcare data. Compromised logs could result in non-compliance, legal penalties, or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade jshERP to a patched version beyond 3.6. Implement strict access controls to restrict /log endpoints to authorized users only. Review and remove any unauthorized log modifications in the database. Disable batch deletion endpoints if not required.

Useful 0 Not Useful 0