JHipster Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in JHipster versions prior to 8.9.0. This vulnerability allows standard users to gain admin rights by manipulating the authorities parameter in the response from the api/account endpoint. The issue arises from inadequate server-side authorization checks, enabling unauthorized access to admin functionalities.

Impact

Exploitation of this vulnerability allows unauthorized users to access admin-level features, including user management and modification of sensitive user information.

Reproduction

To reproduce this vulnerability, register as a standard user on a JHipster application. After logging in, intercept the response from the '/api/account' endpoint, and locate the 'authorities' parameter, which will contain 'ROLE_USER'. Modify this value to 'ROLE_ADMIN' and send the altered response back to the application. The application will accept the change and grant access to admin functionalities.

Remediation

Users can update to JHipster version 8.9.0 or later, where this vulnerability is patched.