Description
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
b3log Symphony
Default version status: unaffected
0 to ≤ 3.6.4affected
pkg:github/88250/symphonyReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/b3log-symphony-admin-endpoints-missing-authorization ↗
- https://github.com/88250/symphony/blob/827a7dd8b74316aa62f370f893a8382a8b45ba0f/src/main/java/org/b3log/symphony/processor/middleware/PermissionMidware.java#L94-L97 ↗
- https://github.com/88250/symphony/blob/827a7dd8b74316aa62f370f893a8382a8b45ba0f/src/main/java/org/b3log/symphony/processor/AdminProcessor.java#L316-L386 ↗
- https://github.com/88250/symphony ↗
- https://www.vulncheck.com/advisories/b3log-symphony-through-3.6.4-missing-authorization-in-admin-console-routes ↗