youlai-boot Unauthorized Access Leading to Privilege Escalation and Account Tampering via Missing @PreAuthorize

Vulnerability Overview youlai-boot is a single-application backend management system based on Spring Boot 3. Its security layer is stateless, with a JWT filter authenticating every request except for a few whitelisted paths (such as login, CAPTCHA, token refresh, WebSocket, and API documentation). Functional-level authorization is implemented solely through Spring Method Security using annotations placed on various handlers. However, there are no MVC interceptors or aspects to enforce permissions, resulting in any authenticated caller being able to access handlers that lack the annotation. This report covers two handlers in version v2.21.1 that changed privilege status and lacked the annotation, while other handlers in the same controller were correctly annotated. Impact Scope Vulnerability 1: Privilege escalation via unauthorized role-permission assignment - Endpoint: - Handler: - Missing Check: - Impact: An authenticated low-privilege user can assign any menu and button permissions to a role, thereby immediately obtaining administrator-level privileges. Vulnerability 2: Account status tampering via unauthorized user status endpoint - Endpoint: - Handler: - Missing Check: - Impact: An authenticated low-privilege user can disable super-administrator (root) or administrator (admin) accounts, thereby preventing these accounts from authenticating, or re-enable previously disabled administrator accounts. Remediation Vulnerability 1: Add the annotation to the handler to ensure that only users with appropriate permissions can invoke this endpoint. Vulnerability 2: Add the annotation to the handler to ensure that only users with appropriate permissions can invoke this endpoint. Detailed Attack Steps Vulnerability 1: Privilege Escalation 1. Root Cause: The platform defines functional-level authorization but ignores annotations on handlers that override role permissions. 2. Attack Flow: - An authenticated low-privilege user calls the endpoint. - This endpoint overwrites the role's set of menu and button permissions and refreshes the role permission cache in Redis. - Due to the lack of authorization checks, the low-privilege user can assign any menu and button permissions to the role. - The permission cache is refreshed within the same call, allowing the caller to immediately obtain administrator-level privileges. Vulnerability 2: Account Status Tampering 1. Root Cause: The platform defines functional-level authorization but ignores annotations on handlers that update user status. 2. Attack Flow: - An authenticated low-privilege user calls the endpoint. - This endpoint enables or disables any user account without authorization checks and without protection against targeting non-privileged users. - The low-privilege user can disable super-administrator (root) or administrator (admin) accounts, thereby preventing these accounts from authenticating, or re-enable previously disabled administrator accounts. Verification Impact and Limitations: Both vulnerabilities require an authenticated caller and were confirmed via static source code analysis in the fixed release commit. Runtime verification was not performed. References CVE Numbers: CWE-862 Missing Authorization, CWE-269 Improper Privilege Management Status: Public disclosure for these two endpoints has not yet been released. At the time of writing, released CVEs cover other endpoints within the same controller (see references and dedup notes). Code Snippets Summary Vulnerability 1: Privilege escalation via unauthorized role-permission assignment. Vulnerability 2: Account status tampering via unauthorized user status endpoint. Remediation: Add annotations to the relevant handlers to ensure that only users with appropriate permissions can invoke these endpoints.

Goal Reached Thanks to every supporter — we hit 100%!

youlai-boot Unauthorized Access Leading to Privilege Escalation and Account Tampering via Missing @PreAuthorize

More from this source