JeeWMS Permission Bypass Vulnerability in AuthInterceptor Component

A permission bypass vulnerability has been identified in JeeWMS versions prior to 2025.01.01. The issue resides in the AuthInterceptor component, where the logic improperly validates request paths against an exclusion list. This flaw allows unauthorized access to sensitive data by circumventing backend verification.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data by bypassing authentication requirements.

Reproduction

To reproduce this vulnerability, access a route that requires authentication. The server will respond with a 302 redirect to the login page, indicating that permission verification is in place. However, by appending a crafted request path that includes sensitive data query parameters, it is possible to bypass the authentication check and access backend interfaces without logging in.