Erxes Incorrect Access Control Vulnerability Allowing Authentication Bypass

A vulnerability in Erxes versions prior to 1.6.1 allows for incorrect access control, where an attacker can bypass authentication by sending a 'User' HTTP header with any user identity. This manipulation enables the attacker to interact with any GraphQL endpoint as the specified user.

Impact

Exploitation of this vulnerability allows any user to impersonate an admin on an Erxes instance, granting access to all application data and the ability to create additional admin accounts for persistent access.

Reproduction

To reproduce this vulnerability, send a request to an Erxes server with a 'User' HTTP header encoded in Base64, representing a user identity. The server will trust this header and grant access as the specified user, bypassing normal authentication processes.

Remediation

Users of Erxes should update to version 1.6.3, which addresses this authentication bypass vulnerability.