Description

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T19:17:20.377Z",
  "pubdate": "2026-09-21T19:17:20.377Z",
  "executiveSummary": "jshERP versions through 3.6 are susceptible to an information disclosure vulnerability within the /user/info API endpoint.\nThe vulnerability involves the failure to redact sensitive credential data, specifically unsalted MD5 password digests, when fulfilling requests for user information.\nAn authenticated attacker can leverage this flaw to enumerate user records and retrieve password hashes by supplying arbitrary user identifiers.\nThe exposure of these hashes facilitates offline cryptographic attacks, such as rainbow table or brute-force decryption, potentially leading to full account takeover or unauthorized lateral movement within the application.\nThe risk is categorized as high, as it exposes the core authentication credentials of all system users. Successful exploitation requires an authenticated session, but the lack of granular authorization controls allows for the unauthorized retrieval of data belonging to any user, including administrative accounts.\nThis flaw underscores a significant failure in secure data handling and improper input validation regarding object-level authorization.",
  "technicalDetails": "The vulnerability exists within the /user/info endpoint of the jshERP application, which fails to perform adequate data sanitization or object-level authorization checks before returning user profile data to the client.\nWhen a user makes a request to this endpoint, the application logic retrieves the requested user record from the underlying database and serializes the object into a JSON response. During this process, the application does not filter sensitive fields, including the field containing the MD5 password digest.\nThe root cause is a lack of server-side data redaction and insufficient access control mechanisms. Specifically, the application does not enforce a policy that restricts access to user profile information to only the owner of that profile or an authorized administrator.\nThe attack flow proceeds as follows: First, an attacker establishes a valid authenticated session with the jshERP platform. Second, the attacker identifies the /user/info endpoint and observes that it accepts user IDs as parameters. Third, the attacker iterates through sequences of integer-based user IDs. Fourth, for each request, the server returns the full user object including the unsalted MD5 hash of the password.\nBecause the hashes are unsalted and MD5 is cryptographically broken, the retrieved digests are highly vulnerable to rapid offline cracking. Once the cleartext passwords are recovered, an attacker can bypass authentication entirely, escalate privileges if administrative credentials are recovered, or gain persistent access to the application.\nThe vulnerability is present in all jshERP versions through 3.6. Since the application provides an API that implicitly trusts the client's requested user ID without validating that the authenticated session corresponds to the requested record, the system is globally exposed to information leakage of credential materials."
}