Description

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-29T00:17:03.777Z",
  "pubdate": "2026-09-29T00:17:03.777Z",
  "executiveSummary": "The mall4j e-commerce platform through version 4.0 contains a critical Broken Access Control vulnerability residing within the UserAddrController component.\nThis vulnerability allows authenticated attackers to bypass authorization checks when invoking specific GET endpoints designed for address data retrieval.\nBy targeting the /user/addr/page and /user/addr/info endpoints, an attacker can perform unauthorized data harvesting, extracting sensitive customer information including full names, contact telephone numbers, and detailed postal address data.\nThe impact is significant, as it facilitates mass unauthorized data exfiltration, violating user privacy and potentially leading to compliance failures regarding data protection regulations.\nThe vulnerability requires an authenticated session to exploit, but it lacks the necessary server-side authorization logic to ensure users can only access their own data, effectively exposing the entire customer address database to any registered user.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of authorization controls within the UserAddrController class. While the application requires a valid authentication token to access these endpoints, it fails to enforce 'Insecure Direct Object Reference' (IDOR) protections or proper ownership verification at the controller level.\nThe vulnerable endpoints are identified as /user/addr/page and /user/addr/info. Under normal security expectations, these endpoints should filter database queries based on the authenticated user's ID to ensure that returned address records correspond strictly to the current session owner.\nInstead, the application processes requests without validating if the requested resource identifier corresponds to the authenticated entity. Consequently, an attacker can systematically iterate through address IDs or query the page endpoint to retrieve records belonging to other users within the system.\nThe attack flow proceeds as follows: First, the attacker establishes a valid authenticated session by logging into the platform as a standard user. Second, the attacker interacts with the vulnerable GET endpoints. By manipulating parameters in the /user/addr/page or /user/addr/info requests, the attacker triggers a database query that returns arbitrary records rather than scoped results.\nBecause the application logic does not perform a secondary check against the owner_id or user_id field, the backend query executes with global scope, returning sensitive customer personally identifiable information (PII).\nThis vulnerability is classified as an IDOR-based Broken Access Control issue. It is present in all mall4j versions up to and including 4.0. Exploitation is possible over standard HTTP/HTTPS protocols, and the attack surface is limited only by the attacker's ability to maintain a valid low-privilege session. The post-exploitation impact includes the full-scale compromise of the customer address database, facilitating further social engineering attacks or data leakage incidents."
}