| タイトル | Dromara UJCMS v12.3.1 CWE-285 Improper Authorization |
|---|
| 説明 | Root Cause
The com.ujcms.cms.core.web.api.UserController exposes multiple user-existence checking endpoints without requiring authentication or authorization.
The affected methods directly query the user database and return a boolean value indicating whether the supplied username, mobile number, or email address exists.
For example:
@GetMapping("/username-exist")
public boolean usernameExist(@Parameter(description = "用户名")
@NotBlank String username) {
return service.selectByUsername(username) != null;
}
The same behavior is implemented by the following methods:
usernameNotExist()
usernameExist()
mobileNotExist()
mobileExist()
emailNotExist()
emailExist()
No authentication or authorization check is performed before returning the result.
Impact
An unauthenticated remote attacker can enumerate registered usernames, mobile phone numbers, and email addresses by submitting arbitrary values to the affected endpoints.
The disclosed information can be used to identify valid accounts and may facilitate subsequent attacks such as password spraying, credential attacks, phishing, or social engineering.
Vulnerability Details and POC
The following endpoints are affected:
/username-exist
/username-not-exist
/mobile-exist
/mobile-not-exist
/email-exist
/email-not-exist
For example, an unauthenticated request can be sent:
GET /api/user/username-exist?username=admin HTTP/1.1
Host: target.example
If the username exists, the application returns:
true
For a username that does not exist, the application returns:
false
Therefore, an attacker can automatically send requests using a username dictionary and determine which usernames are registered.
The same issue exists for the mobile-number and email-address existence-checking endpoints.
No authentication is required to reproduce the issue. |
|---|
| ソース | ⚠️ https://github.com/dromara/ujcms/issues/22 |
|---|
| ユーザー | mjh_123 (UID 92618) |
|---|
| 送信 | 2026年08月23日 17:05 (28 日 ago) |
|---|
| モデレーション | 2026年09月19日 11:19 (27 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 407920 [Dromara UJCMS 迄 12.3.1 UserController UserController.java usernameExist ユーザー名 特権昇格] |
|---|
| ポイント | 20 |
|---|