Authenticated User Role Escalation in jshERP

Executive Summary

jshERP through version 3.6 has a missing authorization flaw in the UserController updateUser handler. Authenticated users can exploit this to assign any role to any user by sending their own user ID with the tenant administrator role ID. This allows low-privilege attackers to escalate their privileges or change roles for other users.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized role assignments in jshERP. Review user role configurations in the database or application logs for suspicious changes where low-privilege users are assigned administrator roles. Look for requests to the UserController updateUser endpoint with modified user IDs or role IDs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive data or administrative functions by escalating their privileges. They might also manipulate other users' roles to perform malicious actions, leading to data breaches or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to the latest version if available. Restrict database access to prevent unauthorized role modifications. Audit all user roles and revoke any unauthorized administrator assignments. Implement strict input validation for user ID and role ID parameters in the updateUser handler.

Useful 0 Not Useful 0