| Titre | ChangeWeDer crm — CRM Customer Management System 0.0.1-SNAPSHOT Authentication Bypass Issues |
|---|
| Description | Improper Authentication Allows Arbitrary Identity Spoofing
1. Vendor
ChangeWeDer
2. Product
crm — CRM Customer Management System
3. Affected Version
0.0.1-SNAPSHOT
The affected code is present in the current master branch. The project does not appear to provide a formal release version; the Maven project version is 0.0.1-SNAPSHOT.
4. Vulnerability Type
CWE-287: Improper Authentication
Secondary classification:
Authentication Bypass / Identity Spoofing
5. Vulnerability Title
Improper Authentication in ChangeWeDer crm Allows Arbitrary Identity Spoofing
6. Affected Component
top.upstudy.crm.utils.LoginUserUtil
Particularly:
releaseUserIdFromCookie()
Related component:
top.upstudy.crm.utils.UserIdBase64
7. Vulnerability Description
The ChangeWeDer crm application contains an improper authentication vulnerability in its cookie-based identity validation mechanism.
The application obtains the user ID from a client-controlled cookie and only verifies whether the supplied user ID exists. It does not cryptographically verify that the cookie was issued by the server or that the supplied identity is legitimately associated with the authenticated client.
The related UserIdBase64 implementation does not provide cryptographic protection. The user ID and timestamp are Base64-encoded, concatenated, reversed, and used as the cookie value. Base64 encoding and string transformation do not provide authenticity or integrity protection and therefore allow an attacker to construct a valid-looking identity cookie.
As a result, an unauthenticated remote attacker can construct a cookie containing the identifier of an existing privileged account, such as an administrator, and access the application as that user.
8. Root Cause
The root cause is that the application treats a client-controlled user identifier as a trusted authentication credential.
The vulnerable authentication flow can be summarized as:
Client-controlled Cookie
→ LoginUserUtil.releaseUserIdFromCookie()
→ extract user ID
→ verify only whether the user ID exists
→ establish the corresponding application identity
No server-side signature, integrity check, or equivalent authentication mechanism is used to bind the cookie to a legitimate authentication event.
The use of Base64 encoding does not mitigate this issue because Base64 is an encoding mechanism rather than an encryption or authentication mechanism.
9. Attack Preconditions
No prior authentication is required.
An attacker only needs network access to the affected CRM application and knowledge of a valid user identifier.
10. Attack Vector
Remote.
The vulnerability can be triggered through a crafted HTTP request containing a forged authentication cookie.
11. Proof of Concept
The vulnerability was reproduced locally against the affected application.
A simplified attack sequence is:
Start the vulnerable CRM application.
Do not authenticate to the application.
Determine the identifier of an existing privileged user.
Construct the corresponding UserIdBase64 cookie value using the application's encoding algorithm.
Send a request to a protected backend resource with the forged cookie.
The application accepts the supplied user ID because it exists in the database.
The attacker is treated as the corresponding privileged user.
In testing, an unauthenticated attacker was able to forge an administrator identity and access the backend.
The original public reproduction report is available in GitHub Issue #2.
12. Security Impact
Successful exploitation allows an unauthenticated remote attacker to impersonate arbitrary existing users.
If the attacker selects an administrator account, the vulnerability can result in complete authentication bypass and unauthorized access to administrative functionality.
The final impact therefore depends on the privileges associated with the targeted account and may include unauthorized access to CRM data and administrative operations.
13. Suggested Remediation
The application should not use a client-controlled user ID as an authentication credential.
Recommended remediation:
Use a random, unpredictable server-side session identifier.
Store the authenticated identity server-side and associate it with the session.
Alternatively, use a cryptographically authenticated token with an appropriate MAC/signature mechanism.
Do not rely on Base64 encoding, reversal, timestamps, or other reversible transformations for authentication.
Validate the authenticity and integrity of every authentication token before establishing the application principal.
Invalidate existing vulnerable authentication cookies after deploying the fix.
14. References
GitHub Issue #2:
https://github.com/ChangeWeDer/crm/issues/2
GitHub Repository:
https://github.com/ChangeWeDer/crm
15. Disclosure Status
The vulnerability was publicly reported to the project maintainer through GitHub Issue #2 on August 20, 2026.
No fix was available at the time of reporting. |
|---|
| La source | ⚠️ https://github.com/ChangeWeDer/crm/issues/2 |
|---|
| Utilisateur | mjh_123 (UID 92618) |
|---|
| Soumission | 20/08/2026 11:24 (il y a 27 jours) |
|---|
| Modérer | 16/09/2026 10:51 (27 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 405552 [ChangeWeDer crm authentification faible] |
|---|
| Points | 20 |
|---|