Missing Authorization in Pig 4.1.1 Exposes User Data

Executive Summary

This vulnerability in pig through 4.1.1 is a missing authorization issue in SysUserController.user. It allows any authenticated user to access other users' profiles via GET /admin/user/details/{id}. Attackers can exploit this to enumerate sequential user IDs and retrieve sensitive data like usernames, real names, phone numbers, emails, third-party account links, and role assignments.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to user profiles by testing GET requests to /admin/user/details/{id} with sequential IDs. Use tools like curl to enumerate user data: curl -u user:pass http://target/admin/user/details/1. Monitor logs for repeated access attempts to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

Low-privilege attackers could exploit this to gather personal data of other users, leading to privacy breaches, identity theft, or targeted phishing attacks. Organizations using this software risk unauthorized access to sensitive user information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related data is exposed. It undermines data protection requirements for confidentiality and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to /admin/user/details/{id} to authorized users only. Update pig to version 4.1.1 or later if available. Implement rate limiting and input validation on user ID parameters. Review and audit user roles to ensure least privilege access.

Useful 0 Not Useful 0