Summary
jshERP through version 3.6 contains an authorization bypass in its userBusiness CRUD endpoints. An authenticated user may create, modify, or delete authorization-relation records without adequate privilege checks, potentially changing user-role mappings and access controls within a tenant.
Affected context
The vulnerability occurs in jshERP deployments using the affected userBusiness CRUD endpoints. It becomes risky when endpoint handlers accept requests from authenticated users but do not verify whether those users are authorized to manage authorization-relation records for the targeted accounts, roles, or functions.
Exploit preconditions
- Attack surface: The userBusiness CRUD API endpoints that manage authorization-relation rows
- Required access: A valid authenticated account capable of reaching the affected endpoints
- Trigger point: Create, update, or delete operations against user-role or role-function relationship data
- Why exploitation is possible: Server-side authorization checks do not adequately confirm that the requester may modify the targeted authorization records
Why this happens
The underlying bug is missing server-side authorization enforcement on sensitive CRUD operations. The application appears to authenticate the requester but fails to consistently perform an object- and function-level privilege check before changing authorization relationships. This maps to CWE-862: Missing Authorization, where access to a protected operation is not adequately restricted after authentication.
Potential impact
- An authenticated user may escalate privileges by assigning unauthorized roles
- Attackers could remove or alter access assigned to other accounts
- User-role and role-function relationships may be manipulated across the tenant
- Unauthorized users could gain access to administrative or business functions
- Tenant authorization integrity and audit reliability could be weakened
General mitigation guidance
Mitigation generally focuses on enforcing authorization centrally and treating authorization-relation data as highly sensitive.
Common defensive patterns include:
- Apply server-side, deny-by-default authorization checks to every create, update, and delete operation
- Verify both the requested action and ownership or administrative scope for each targeted tenant, user, role, and function
- Avoid relying on client-side controls, hidden fields, or endpoint naming to enforce privileges
- Use centralized policy enforcement and consistent permission checks across all equivalent CRUD paths
- Restrict administrative capabilities through least privilege and separate duties where practical
- Record and review changes to role mappings and other access-control relationships
How teams detect issues like this
Organizations can look for missing authorization through:
- Static analysis rules identifying sensitive CRUD handlers without nearby policy or permission checks
- Code review signals such as direct writes to role, user, permission, or relationship tables from authenticated routes
- Tests that exercise horizontal and vertical access boundaries using accounts with different tenant and administrative scopes
- API policy enforcement requiring explicit authorization decisions for every mutation of access-control data
- Audit monitoring for unexpected role assignments, permission removals, cross-account changes, or unusual bursts of authorization updates
Automated application-security review tools may help identify endpoints that authenticate users without enforcing operation- or object-level authorization.
