| शीर्षक | Jeebase 0.0.1 Mass Assignment |
|---|
| विवरण | A mass assignment vulnerability exists in the /user/update/info endpoint of Jeebase 0.0.1. The endpoint requires authentication but does not properly restrict which attributes of the UpdateUser object can be modified by the client.
The controller attempts to construct a restricted UpdateUser object containing only permitted fields and the ID of the currently authenticated user. However, due to an implementation error, the application passes the original client-controlled user object to userService.updateUser(user) instead of the restricted object.
As a result, an authenticated low-privileged user can provide arbitrary attributes, including the ID and password of another user, and modify that user's account. During testing, a normal user was able to change the password of an administrator account and subsequently authenticate as the administrator, resulting in account takeover and privilege escalation.
The vulnerability is caused by improper handling of client-controlled object attributes and can be exploited without interaction from the victim. |
|---|
| स्रोत | ⚠️ https://github.com/wmz1930/Jeebase/issues/88 |
|---|
| उपयोगकर्ता | mjh_456 (UID 101155) |
|---|
| सबमिशन | 10/09/2026 11:48 AM (25 दिन पहले) |
|---|
| संयम | 04/10/2026 11:22 AM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413417 [Jeebase 0.0.1 UserService /user/update/info updateUser user/tempUser अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|