Description

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T00:18:12.277Z",
  "pubdate": "2026-08-28T00:18:12.277Z",
  "executiveSummary": "The /storage/upload endpoint within cjbi admin3 version 3.0.0 exhibits a critical lack of access control mechanisms, rendering the system vulnerable to unauthorized file management operations.\nThis vulnerability manifests as two distinct security failures: an Insecure Direct Object Reference (IDOR) or Broken Access Control issue allowing unauthenticated users to download files, and an unrestricted upload vulnerability for authenticated users.\nThe vulnerability allows any authenticated user to upload arbitrary files to the server, while simultaneously permitting anonymous, unauthenticated attackers to retrieve any stored content.\nThe risk implication is severe, as it facilitates potential Remote Code Execution (RCE) if executable scripts (such as .php, .jsp, or .asp files) are uploaded and subsequently accessed through the web server.\nFurthermore, the unauthorized exposure of sensitive files stored on the server poses a significant risk to data confidentiality and integrity.\nExploitation requires no specialized administrative privileges, significantly lowering the barrier for entry for malicious actors operating within the network.",
  "technicalDetails": "The root cause of this vulnerability lies in the total absence of server-side authorization checks on the /storage/upload endpoint in cjbi admin3 v3.0.0. The application fails to validate the session state or the identity of the requester before processing upload requests, and it fails to implement access control lists (ACLs) or authentication requirements for file retrieval operations.\nRegarding the upload vector: Any authenticated user, regardless of their role or permission level, can interact with the /storage/upload endpoint to transmit arbitrary files. The system lacks file type validation, extension filtering, or content inspection. An attacker can upload malicious web shells, scripts, or malware payloads directly to the application's storage directory. Once uploaded, the attacker can leverage the web server's ability to execute these files if the storage directory is mapped to the web root, resulting in full server compromise.\nRegarding the download/access vector: The storage component is effectively public. The lack of authentication checks on the download or file-access path means that an anonymous, unauthenticated attacker can retrieve any file that has been stored on the server. By probing or enumerating predictable file paths, an attacker can exfiltrate sensitive configuration files, user data, or backups that may have been uploaded to the system.\nAttack Flow: 1. An attacker identifies the /storage/upload endpoint through application enumeration. 2. To upload, the attacker uses a standard HTTP POST request to inject a malicious script (e.g., a web shell) into the server's storage environment. 3. Because there is no permission validation, the file is successfully persisted. 4. For retrieval, an unauthenticated attacker performs an HTTP GET request against the storage path (e.g., /storage/filename.ext) to download or interact with the uploaded file. 5. If the file is a malicious script, the attacker accesses it via the browser or command-line tool, triggering the execution of the payload with the privileges of the web application server process.\nThis vulnerability persists across the version 3.0.0 build, as the application logic lacks the necessary middleware or interceptors to verify user identity or enforce resource-based access policies before executing filesystem I/O operations."
}