CVE-2023-29922

Vulnerability

Overview

CVE-2023-29922 describes an incorrect access control vulnerability in PowerJob V4.3.1, specifically in the /user/save interface. The issue stems from a lack of authentication or authorization checks on this endpoint, which is meant to be used for user creation. The official advisory indicates that the interface does not verify whether the requester has the necessary permissions to create new users, effectively leaving the endpoint open to unauthenticated requests [1][3].

Exploitation

Details

An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the /user/save endpoint with a JSON payload containing user details (username, phone, email, webHook). The request does not require any authentication token or session, as demonstrated in the bug report where a simple POST request successfully creates a user without any permissions [3]. The attack surface is broadened because PowerJob is an enterprise job scheduling framework with a web UI, and the vulnerable endpoint is exposed on the default HTTP port (7700) [2][3].

Impact

Successful exploitation allows an attacker to create arbitrary user accounts within PowerJob. With a newly created account, the attacker gains access to the job scheduling platform, potentially enabling them to perform privileged actions such as creating or modifying scheduled tasks, viewing or modifying job configurations, and accessing sensitive execution logs. This could lead to further compromise of the underlying system if malicious tasks are executed [1][2].

Mitigation

Status

As of the publication date, the vulnerability was reported in PowerJob V4.3.1. Users are advised to apply any patches provided by the maintainers. The issue was reported via the project's GitHub issues page, and users should monitor the repository for updates or apply workarounds such as restricting network access to the vulnerable endpoint [1][3].