Threats affecting pkg:github/jshERP

jshERP versions up to 3.6 have a missing authorization vulnerability in the POST /user/batchSetStatus endpoint. This flaw allows authenticated users with low privileges to change the account status of other users within their tenant. Exploitation can result in disabling all non-owner accounts, including administrators, effectively locking them out, or re-enabling disabled accounts.

jshERP versions up to 3.6 have a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data without proper role checks. This includes creating settlement accounts, products with initial stock, departments, and dictionary entries via specific POST endpoints.

jshERP versions up to 3.6 have an information disclosure vulnerability allowing authenticated users with low privileges to access sensitive platform-wide configuration secrets. This occurs via the getInfoByKey handler in the PlatformConfigController, which does not properly restrict access to certain keys. While keys like aliOss and weixin are blocked, others such as email_auth_code and activation_code can be retrieved, exposing SMTP authorization codes and activation secrets.

jshERP versions up to 3.6 have a mass assignment vulnerability in the UserController update handler. Authenticated users can overwrite protected fields such as tenant_id and password by sending a crafted PUT request. This allows attackers to switch tenants on next login or change other users' password hashes, potentially leading to account takeover.

jshERP versions up to 3.6 have a missing authorization vulnerability in the UserController updateUser handler. This flaw allows authenticated users with low privileges to assign arbitrary roles, including tenant administrator roles, to themselves or other users. This can lead to privilege escalation or unauthorized role reassignment.

jshERP versions up to 3.6 have an improper authorization vulnerability that allows low-privilege authenticated users to access settlement account ledgers beyond their permitted scope by manipulating the accountId parameter in a specific API call. This enables unauthorized viewing of sensitive financial details such as bill numbers, counterparties, amounts, and remarks within the tenant.

jshERP versions up to 3.6 have an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by manipulating the status parameter in a specific POST request. This bypasses audit permission checks and multi-level approval workflows, enabling the creation of audited bills that impact stock and reporting.

jshERP versions up to 3.6 have an incorrect authorization vulnerability in the GET /supplier/exportExcel endpoint. Authenticated users with restricted data scope can bypass role-based restrictions and export all supplier, customer, and member records. This exposes sensitive information such as contacts, phone numbers, tax numbers, bank accounts, and balances.

jshERP versions up to 3.6 contain an authorization bypass vulnerability that allows authenticated users with limited access to personal or department data to view other users' purchase, sales, and inventory bills. This occurs when an attacker includes purchaseStatus=0 in a search request, causing the service to ignore creator-based filtering and expose data across the tenant.

jshERP versions up to 3.6 have an authorization bypass vulnerability that allows authenticated users to access data from warehouses they are not assigned to by manipulating depotId or depotIds parameters. This bypass occurs even when warehouse restrictions are enabled, exposing sensitive stock and sales data.

jshERP versions up to 3.6 have a missing authorization vulnerability in the LogController. This flaw allows any authenticated user, including low-privilege users, to access the tenant's operation audit logs by sending GET requests to /log/list or /log/info. The exposed information includes other users' login names, client IP addresses, and actions.

jshERP versions up to 3.6 have a missing authorization vulnerability in the LogController. This flaw allows any authenticated user, including low-privilege users, to create, modify, or delete audit log entries via specific endpoints. Attackers can fabricate log entries, alter user and IP information, or erase logs to conceal their activities.

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.