Description
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guchengwuyue yshop-crm
Default version status: unaffected
0 to ≤ 2.1.3affected
pkg:github/guchengwuyue/yshop-crmReferences
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C10_system_user_page_enum.py ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-system/yshop-module-system-biz/src/main/java/co/yixiang/yshop/module/system/controller/admin/user/UserController.java#L92 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-system/yshop-module-system-biz/src/main/java/co/yixiang/yshop/module/system/service/user/AdminUserServiceImpl.java#L251 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-framework/yshop-spring-boot-starter-biz-data-permission/src/main/java/co/yixiang/yshop/framework/datapermission/core/rule/dept/DeptDataPermissionRule.java#L115 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30 ↗
- https://github.com/guchengwuyue/yshop-crm ↗
- https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-disabled-annotation-on-system-user-listing ↗