smart-admin Authorization Bypass via Unrestricted Read of Super Password Leading to Authentication Bypass

Vulnerability Overview Vulnerability Name: Unauthorized Read of Master Password → Authentication Bypass to Hijack Any Account #137 Vulnerability Description: The endpoint lacks proper authorization checks, allowing any authenticated user with unauthorized access to read the plaintext (master password). By using this value in the login endpoint, it triggers the system's built-in "master password" backdoor, bypassing password hash verification and two-factor authentication (2FA), enabling login as any account (e.g., super administrator). Severity: P1 (High) Type: Unauthorized Sensitive Configuration Read + Authentication Bypass (Chained) Affected Versions: smart-admin-api-java8-springboot3, smart-admin-api-java8-springboot2 Impact Scope Any authenticated standard user or unauthorized user Capability to read the plaintext Capability to bypass password hash verification and two-factor authentication (2FA) Capability to hijack any account identity, including super administrator access Remediation Plan 1. Missing Interface Permissions (Root Cause): lacks the annotation, meaning the interceptor does not enforce any method-level constraints on standard users. 2. No Isolation for Sensitive Configurations: The configuration query interface allows retrieval of sensitive values like , which are returned in plaintext without masking. 3. Design Flaw in Master Password Backdoor: The implementation uses plaintext comparison; once matched, it bypasses password verification and 2FA. The default value is a known weak password. POC Code Attack Chain 1. Step 1: The standard user logs in normally to obtain a valid token. 2. Step 2: The user calls the authorization-less configuration query endpoint to retrieve the master password. 3. Step 3: The user logs in using the master password, triggering the backdoor, and hijacks the super administrator account.

Goal Reached Thanks to every supporter — we hit 100%!

smart-admin Authorization Bypass via Unrestricted Read of Super Password Leading to Authentication Bypass

More from this source