microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.8%
exploitation probability
0.8%top 43% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorization enforcement.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
zlt2000 · microservices-platformpublic PoCs found — 5
cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.pyunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C04_save_or_update_user.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C06_set_role_to_user.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C10_reset_password_by_id.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C11_list_all_users.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C21_delete_es_index.pyhttps://github.com/zlt2000/microservices-platformhttps://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/properties/UrlPermissionProperties.java#L25https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-commons/zlt-auth-client-spring-boot-starter/src/main/java/com/central/oauth2/common/service/impl/DefaultPermissionServiceImpl.java#L59https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-gateway/sc-gateway/src/main/resources/application.yml#L122https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-missing-authorization-via-disabled-url-permission-checking