Description
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jetlinks JetLinks Community
Default version status: unaffected
0 to ≤ 2.10.0affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-community-transparent-codec-save-authz-bypass ↗
- https://github.com/jetlinks/jetlinks-community/blob/60ecc9f65d96acfd38da8daecdb0062fc72034f3/jetlinks-manager/rule-engine-manager/src/main/java/org/jetlinks/community/rule/engine/web/AlarmConfigController.java#L63-L73 ↗
- https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java#L206-L218 ↗
- https://github.com/jetlinks/jetlinks-community ↗
- https://www.vulncheck.com/advisories/jetlinks-community-through-2.10.0-missing-authorization-via-alarm-enable-disable-endpoints ↗