production_ssm Incorrect Access Control Vulnerability Allowing Information Leakage

A vulnerability exists in production_ssm version 0.0.1-SNAPSHOT due to incorrect access control in the '/user/list' component. This flaw allows attackers to access sensitive information by sending a crafted payload, bypassing authentication requirements.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the '/user/list' API endpoint without proper authentication. The request will be denied. However, by manipulating the request to include the payload '/ajaxLogin;/../user/list', authentication can be bypassed, allowing access to the sensitive information.