Information Disclosure in jshERP via PlatformConfigController

Executive Summary

jshERP through version 3.6 has an information disclosure vulnerability where authenticated users can read platform-wide configuration secrets via the getInfoByKey handler in PlatformConfigController. Low-privilege users can request arbitrary platformKey values like email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, as only aliOss and weixin keys are blocked.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to platform configuration endpoints. Monitor logs for requests to getInfoByKey handler in PlatformConfigController. Verify if low-privilege users are accessing sensitive keys like email_auth_code or activation_code.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this to access sensitive secrets like SMTP authorization codes or activation secrets, potentially leading to unauthorized email access, account takeovers, or further system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to exposed secrets.

Useful 0 Not Useful 0

Mitigation Strategies

Update jshERP to the latest version. Restrict access to PlatformConfigController endpoints. Block requests for sensitive keys like email_auth_code or activation_code. Review and audit user permissions to ensure least privilege.

Useful 0 Not Useful 0