| 标题 | Frappe Technologies Pvt. Ltd. Frappe HR v16.15.0 Authorization Bypass Through User-Controlled Key (CWE-639) |
|---|
| 描述 | Frappe HR v16.15.0 contains a shared IDOR flaw across get_expense_claims, get_shift_requests and get_attendance_requests APIs, allowing authenticated users to read other employees' financial and attendance records via uncontrolled employee parameter.
Vulnerability Overview
A cross-user authorization bypass (CWE-639) exists in multiple APIs sharing the unsafe get_filters helper function in hrms/api/__init__.py v16.15.0.
Affected functions: get_expense_claims (516-557), get_shift_requests (179-215), get_attendance_requests (218-253). The shared get_filters function directly uses attacker-supplied employee ID without permission validation when for_approval=false, enabling horizontal privilege escalation.
Vulnerable Logic
get_expense_claims passes user-controlled employee parameter to get_filters; line 281 sets filters.employee = employee with no frappe.has_permission("Employee", "read", employee) verification. The query returns full records of the target employee’s expense claims, shift requests and attendance logs.
Attack Vector
Authenticated remote HTTP POST to /api/method/hrms.api.get_expense_claims with JSON body:
{"employee": "EMP-TARGET-001"}
Valid session cookie is the only requirement. The same exploitation pattern applies to get_shift_requests and get_attendance_requests endpoints.
Impact
Attackers can retrieve third-party employees’ expense amounts, approval status, shift schedules and attendance history, leaking sensitive financial and work-time data across the organization.
Root Cause & Remediation
Root cause: The get_filters helper does not validate whether the requesting user has read access to the target employee record before applying user-controlled filter values.
Reference: get_expense_claim_summary safely restricts data to current authenticated employee via get_current_employee().
CVSS v3.1 Score: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Discoverer: [Ordinaryzyx] |
|---|
| 来源 | ⚠️ https://github.com/frappe/hrms |
|---|
| 用户 | zyx122126 (UID 100375) |
|---|
| 提交 | 2026-08-09 13時44分 (2 月前) |
|---|
| 管理 | 2026-09-27 12時58分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410876 [Frappe HR 直到 16.15.0 Permission Validation hrms/api/__init__.py employee 权限提升] |
|---|
| 积分 | 19 |
|---|