Description
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lenve vhr
Default version status: unaffected
0 to ≤ 03abbd35af24e55368ce4e09f4038dc2aba3ff5faffected
pkg:github/lenve/vhrReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vhr-chat-hrs-password-disclosure ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/ChatController.java#L12-L20 ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml#L26-L28 ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-model/src/main/java/org/javaboy/vhr/model/Hr.java#L138-L140 ↗
- https://github.com/lenve/vhr ↗
- https://www.vulncheck.com/advisories/vhr-through-commit-03abbd3-information-disclosure-of-operator-password-hashes-via-get-chat-hrs ↗