PowerJob Unauthorized Access Vulnerability in User List Endpoint

A vulnerability exists in PowerJob versions through 5.1.2, allowing unauthenticated users to access the '/user/list' endpoint without proper authorization. This flaw enables the retrieval of user information, creating a vertical authorization issue. The vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability leads to unauthorized access to user information, bypassing normal authorization controls.

Reproduction

To reproduce this vulnerability, send a GET request to the '/user/list' endpoint without any authentication. The response will include the user list, demonstrating the lack of authorization checks.

Remediation

It is recommended to add proper authorization controls to the '/user/list' endpoint by using the '@ApiPermission' annotation.