Yeqifu Warehouse Improper Authorization Vulnerability in Permission Management Component

A vulnerability exists in Yeqifu Warehouse versions up to commit aaf29962ba407d22d991781de28796ee7b4670e4, specifically within the Permission Management component. The issue arises in the PermissionController.java file, affecting the addPermission, updatePermission, and deletePermission functions. This vulnerability allows improper authorization, as the CRUD endpoints for permission management are accessible to any authenticated user. Consequently, attackers could exploit this flaw to create, modify, or delete permissions, potentially leading to unauthorized privilege escalation.

Impact

Exploitation of this vulnerability could disrupt the application's authorization system, allowing for unauthorized changes to permission levels and roles, which could be used to escalate privileges within the application.

Reproduction

To reproduce this vulnerability, log in as a user with low privileges. Then, send a request to the deletePermission endpoint, including the ID of the permission to be deleted. The request will be processed successfully, and the permission will be removed. This exploitation can be verified by logging in as a super admin and checking the permissions, where the deleted permission will no longer be present.