Unauthorized Log Access in jshERP

Executive Summary

jshERP through version 3.6 has a missing authorization vulnerability in the LogController component. This flaw allows any authenticated user, even those with low privileges, to access and read the tenant's operation audit logs by sending GET requests to specific endpoints like /log/list or /log/info. This exposes sensitive information such as other users' login names, client IP addresses, and actions.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized GET requests to /log/list or /log/info endpoints in jshERP logs. Monitor network traffic for suspicious access to these paths by low-privilege users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive audit logs, exposing user login names, IP addresses, and actions. Attackers with low privileges could gather intelligence on other users' activities, potentially leading to further attacks like session hijacking or privilege escalation. It compromises confidentiality and trust within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can violate compliance requirements under GDPR and HIPAA by exposing personally identifiable information (PII) and sensitive user activity logs. GDPR mandates strict protection of personal data, while HIPAA requires safeguarding protected health information. Unauthorized access to such logs can result in legal penalties, loss of trust, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update jshERP to the latest version. Restrict access to /log/list and /log/info endpoints to authorized users only. Review logs for past unauthorized access.

Useful 0 Not Useful 0