| タイトル | Jeebase 0.0.1 Mass Assignment |
|---|
| 説明 | A mass assignment vulnerability exists in the /user/update/info endpoint of Jeebase 0.0.1. The endpoint requires authentication but does not properly restrict which attributes of the UpdateUser object can be modified by the client.
The controller attempts to construct a restricted UpdateUser object containing only permitted fields and the ID of the currently authenticated user. However, due to an implementation error, the application passes the original client-controlled user object to userService.updateUser(user) instead of the restricted object.
As a result, an authenticated low-privileged user can provide arbitrary attributes, including the ID and password of another user, and modify that user's account. During testing, a normal user was able to change the password of an administrator account and subsequently authenticate as the administrator, resulting in account takeover and privilege escalation.
The vulnerability is caused by improper handling of client-controlled object attributes and can be exploited without interaction from the victim. |
|---|
| ソース | ⚠️ https://github.com/wmz1930/Jeebase/issues/88 |
|---|
| ユーザー | mjh_456 (UID 101155) |
|---|
| 送信 | 2026年09月10日 11:48 (25 日 ago) |
|---|
| モデレーション | 2026年10月04日 11:22 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413417 [Jeebase 0.0.1 UserService /user/update/info updateUser user/tempUser 特権昇格] |
|---|
| ポイント | 20 |
|---|