Description

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T13:17:32.003Z",
  "pubdate": "2026-10-12T13:17:32.003Z",
  "executiveSummary": "jshERP versions up to and including 3.6 are susceptible to a critical mass assignment vulnerability within the UserController update handler. This flaw arises from improper input validation, allowing authenticated users to inject unauthorized data into protected object fields during state transition requests.\nThe vulnerability enables attackers to perform unauthorized privilege escalation and lateral movement across tenant boundaries. By manipulating request parameters during a PUT /user/update operation, an attacker can modify sensitive attributes such as tenant_id and account password hashes. This allows for total account takeover or unauthorized access to alternative administrative environments.\nGiven that the application processes user-supplied input without implementing an allow-list or proper data binding constraints, attackers can override internal security identifiers. This vulnerability poses a severe risk to multi-tenant environments, as it undermines the logical isolation between tenants. Successful exploitation requires an authenticated session, though the scope of compromise extends to arbitrary account takeover and complete tenant environment infiltration.\nDue to the nature of the vulnerability, it is classified as a significant security deficiency in input handling that necessitates immediate code-level remediation to enforce strict property binding.",
  "technicalDetails": "The vulnerability resides in the UserController update handler, which fails to implement secure data transfer object (DTO) patterns or explicit field-level sanitization during the processing of HTTP PUT requests. The application relies on automated data binding mechanisms that map incoming JSON fields directly to underlying user entity objects without filtering sensitive metadata or internal identification fields.\nThe root cause is identified as a lack of mass assignment protection. In a standard Java or Spring-based architecture, when an update handler accepts a request body and binds it directly to a database entity, any parameter present in the request that shares a name with an entity property is automatically persisted. Because the application exposes the tenant_id and password fields to the setter methods of the user model, the handler accepts these fields as legitimate input.\nThe attack flow follows a structured exploitation path. An attacker must first possess an authenticated session within the jshERP platform. Upon establishing this session, the attacker initiates a PUT /user/update request. Within the request body, the attacker includes keys corresponding to protected fields, such as 'tenant_id' or 'password'.\nBy modifying 'tenant_id', the attacker can trigger a logic flaw that effectively migrates their user account to a different tenant context upon subsequent authentication attempts. By modifying the 'password' field, the attacker can supply a new, arbitrary hash, thereby overwriting the password hash of the current user or, if the API logic permits, modifying the credentials of other user profiles if they can manipulate the user ID reference within the update parameters.\nThis behavior facilitates account takeover, as the system does not differentiate between user-controlled updates and administrative configuration changes. The application layer fails to perform server-side verification to ensure that the fields being updated are permissible for the current user role, effectively bypassing business logic that intends to keep tenant configurations immutable for non-superusers. Post-exploitation, an attacker can maintain persistent, unauthorized access to target tenants or escalate their privileges to assume the identity of other users within the environment, leading to a complete compromise of data confidentiality and integrity."
}