| 제목 | Dromara UJCMS v12.3.1 CWE-285 Improper Authorization |
|---|
| 설명 | Root Cause
The com.ujcms.cms.core.web.api.UserController exposes multiple user-existence checking endpoints without requiring authentication or authorization.
The affected methods directly query the user database and return a boolean value indicating whether the supplied username, mobile number, or email address exists.
For example:
@GetMapping("/username-exist")
public boolean usernameExist(@Parameter(description = "用户名")
@NotBlank String username) {
return service.selectByUsername(username) != null;
}
The same behavior is implemented by the following methods:
usernameNotExist()
usernameExist()
mobileNotExist()
mobileExist()
emailNotExist()
emailExist()
No authentication or authorization check is performed before returning the result.
Impact
An unauthenticated remote attacker can enumerate registered usernames, mobile phone numbers, and email addresses by submitting arbitrary values to the affected endpoints.
The disclosed information can be used to identify valid accounts and may facilitate subsequent attacks such as password spraying, credential attacks, phishing, or social engineering.
Vulnerability Details and POC
The following endpoints are affected:
/username-exist
/username-not-exist
/mobile-exist
/mobile-not-exist
/email-exist
/email-not-exist
For example, an unauthenticated request can be sent:
GET /api/user/username-exist?username=admin HTTP/1.1
Host: target.example
If the username exists, the application returns:
true
For a username that does not exist, the application returns:
false
Therefore, an attacker can automatically send requests using a username dictionary and determine which usernames are registered.
The same issue exists for the mobile-number and email-address existence-checking endpoints.
No authentication is required to reproduce the issue. |
|---|
| 원천 | ⚠️ https://github.com/dromara/ujcms/issues/22 |
|---|
| 사용자 | mjh_123 (UID 92618) |
|---|
| 제출 | 2026. 08. 23. PM 05:05 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 19. AM 11:19 (27 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 407920 [Dromara UJCMS 까지 12.3.1 UserController UserController.java usernameExist 사용자 이름 권한 상승] |
|---|
| 포인트들 | 20 |
|---|