Summary
A high-severity authorization vulnerability in Tacomall 1.0.0 affects the API administration backend's staff-creation logic. Remote attackers may manipulate authorization-related parameters such as isAdmin or jobId to obtain privileges that should not be granted when the endpoint is reachable and insufficiently protected.
Affected context
The issue occurs in the OrgStaffServiceImpl.add function within ApiMaApplication.java, part of Tacomall's api-admin backend. It becomes risky where remote requests can reach the staff-management endpoint and the application relies on client-supplied authorization or role parameters without enforcing the intended permissions and values on the server.
Exploit preconditions
- Attack surface: Remotely accessible API administration endpoint
- Required access: Any access level that permits requests to reach the affected staff-management function; the exact authentication requirement depends on deployment configuration
- Trigger point: Processing of the
isAdminorjobIdarguments byOrgStaffServiceImpl.add - Why exploitation is possible: Authorization-sensitive values may be accepted or applied without sufficient server-side permission checks, allowing an attacker to influence the privileges assigned to a created or modified staff account
Why this happens
The underlying flaw is an authorization design error in which security-relevant role or privilege attributes are influenced by request parameters without reliably validating the caller's authority and the permitted value transitions. This maps primarily to CWE-285: Improper Authorization and is also related to CWE-266: Incorrect Privilege Assignment, because the application may assign administrative or otherwise elevated capabilities based on insufficiently trusted input.
Potential impact
- An attacker may obtain unauthorized administrative or staff privileges
- The application may permit access to protected management functions
- Sensitive business or user data could be viewed or modified
- Accounts, roles, or operational settings could be changed without proper authorization
- Compromised privileges could support further attacks against connected services
General mitigation guidance
Mitigation generally focuses on making authorization decisions server-controlled, explicit, and independent of client-provided privilege fields.
Common defensive patterns include:
- Deriving administrative status and role assignments from trusted server-side policy rather than request parameters
- Enforcing object-level and function-level authorization checks before staff creation or modification
- Allowing only approved privilege transitions for callers with the necessary administrative authority
- Applying least privilege to service accounts, administrative roles, and API access tokens
- Validating identifiers such as job or role references against the caller's authorized scope
- Treating client-supplied authorization flags as untrusted and ignoring or rejecting them when they conflict with policy
- Recording and reviewing security-sensitive account and privilege changes
How teams detect issues like this
Detection can combine static analysis, review of authorization flows, and runtime policy monitoring.
Useful approaches include:
- Searching for endpoints that bind request parameters directly to role, administrator, permission, or ownership fields
- Reviewing code paths where authorization checks occur after account or privilege changes rather than before them
- Flagging controllers and service methods that trust Boolean privilege flags or identifiers supplied by clients
- Testing each staff-management operation with users holding different privilege levels
- Enforcing API policies that require explicit authorization for role assignment and privilege escalation
- Monitoring audit logs for unexpected administrative account creation or privilege changes
Automated code review and security testing tools may help identify missing authorization checks and unsafe privilege flows.
