CVE-2026-107830 in Jivejdon
Summary
by MITRE • 10/09/2026
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Jivejdon versions ranging from commit e0306088 through ee67a65e represents a critical failure in access control mechanisms, specifically manifesting as an absence of rate limiting on an unauthenticated endpoint. The affected component is the /account/smsVRAction endpoint, which is processed by the SmsQQAction handler within the application's backend logic. This architectural flaw allows any external actor to interact with the SMS sending functionality without requiring prior authentication or verification of user identity. In secure web applications, actions that trigger costly third-party services such as Short Message Service (SMS) gateways must be strictly gated behind authentication and subjected to rigorous rate limiting policies to prevent abuse. The lack of these controls transforms a standard administrative or utility function into a vector for resource exhaustion and harassment attacks.
The operational mechanics of this exploitation involve two primary phases: session manipulation and automated request flooding. An attacker first interacts with the newAccount.jsp page, which serves as an entry point for account creation or initialization processes. By accessing this page, the adversary can manipulate server-side session attributes to establish a valid context within the application's state management system. This step is crucial because it allows the subsequent requests to be processed by the backend logic that expects authenticated user data, even though no actual credentials were provided. Once the session is established with these manipulated attributes, the attacker proceeds to repeatedly invoke the /account/smsVRAction endpoint. Because there are no throttling mechanisms in place, such as IP-based limits, per-user quotas, or CAPTCHA challenges, the application processes each request individually and immediately forwards it to the Tencent Cloud SMS gateway for delivery.
The impact of this vulnerability is twofold, affecting both the target recipients and the service provider's financial resources. On one hand, attackers can use this mechanism to harass arbitrary phone numbers by sending them unsolicited verification codes or messages at a high frequency. This constitutes a denial-of-service against individual users who may be overwhelmed by notifications or subjected to social engineering attacks using these automated texts. More significantly, from an organizational perspective, the vulnerability leads to severe financial loss through resource exhaustion. Since each SMS sent incurs a cost charged to the operator's Tencent Cloud account, the ability to send unlimited messages allows malicious actors to rapidly deplete the organization's prepaid balance or incur substantial unexpected charges on their credit line. This type of attack is often referred to as billing fraud or cloud resource abuse and can result in service interruption for legitimate users if the SMS quota is exhausted before the issue is detected and mitigated.
From a classification standpoint, this vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling, which describes scenarios where insufficient control over resource consumption leads to denial-of-service conditions. Additionally, it falls under CWE-284: Improper Access Control, as the system fails to enforce proper restrictions on unauthenticated users performing sensitive actions. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1595.002: Active Scanning: Vulnerability Scanning, specifically when used for exploitation, and more accurately to T1496: Resource Hijacking, where the attacker leverages the victim's resources (in this case, SMS credits) for malicious purposes such as harassment or financial drain. The lack of input validation on session attributes further touches upon CWE-20: Improper Input Validation, although the primary failure is in access control and rate limiting rather than injection flaws.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. First and foremost, developers should implement strict rate limiting policies for all endpoints that interact with external paid services like SMS gateways. This includes setting limits based on IP address, user session ID, or phone number destination to prevent rapid-fire requests from any single source. Second, the /account/smsVRAction endpoint must be secured by enforcing authentication requirements, ensuring that only verified users can trigger SMS verification processes. If unauthenticated access is required for specific use cases like initial account registration, a CAPTCHA mechanism should be integrated to distinguish human users from automated bots and add friction to mass requests. Furthermore, input validation on session attributes handled in newAccount.jsp must be strengthened to prevent manipulation of internal state variables that could bypass security checks. Finally, monitoring systems should be configured to alert administrators when SMS usage spikes abnormally or when specific endpoints are accessed at frequencies inconsistent with normal user behavior, allowing for rapid detection and response to ongoing abuse attempts.