CVE-2023-29923

Vulnerability

Overview CVE-2023-29923 describes an insecure permissions vulnerability in PowerJob V4.3.1, an enterprise job scheduling middleware. The issue resides in the /job/list interface, which fails to properly enforce access controls. An attacker can manipulate the appId parameter in a POST request to view job details belonging to any application, bypassing intended authorization checks [1][3].

Exploitation

Details Exploitation requires network access to the PowerJob server and the ability to send HTTP POST requests to the /job/list endpoint. No authentication is required, as the vulnerability allows unauthenticated users to enumerate job information by simply altering the appId value in the JSON payload [3]. The proof-of-concept demonstrates that an attacker can retrieve data from arbitrary applications by crafting requests like {"appId":1,"index":0,"pageSize":10} [3].

Impact

An attacker can list jobs for any application managed by PowerJob, potentially leaking sensitive information about scheduled tasks, execution parameters, and application configurations. This exposure could aid in further attacks, such as understanding system topology or identifying vulnerable jobs to manipulate [1].

Mitigation

Status As of the published CVE date (April 2023), PowerJob V4.3.1 is affected. Users should upgrade to a patched version or apply security controls such as network segmentation or authentication enforcement at the API gateway [1][2]. The issue was reported via the project's GitHub issue tracker, indicating the development team has been notified [3].