PowerJob Missing Authorization Vulnerability in OpenAPIController

A vulnerability allowing unauthorized access has been identified in PowerJob versions through 5.1.2. This issue arises from multiple unauthenticated endpoints in the OpenAPIController, particularly the /openApi/runJob endpoint, which lacks proper authorization checks. As a result, an attacker can remotely exploit this vulnerability to access or manipulate resources without authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, potentially allowing access to sensitive data or the ability to execute tasks without proper authorization.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /openApi/runJob endpoint with a jobId and appId parameter. This request can be made without any authentication, demonstrating the lack of authorization checks on this endpoint.

Remediation

It is recommended to add proper authorization checks by using the @ApiPermission annotation on the affected endpoints.