Description
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
roinli HUIZHI-ChargeOS-cloud
Default version status: unaffected
0 to ≤ 3.0.9affected
pkg:github/roinli/HUIZHI-ChargeOS-cloudReferences
- https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor ↗
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28 ↗
- https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge ↗