Executive brief
cjbi admin3 is a Spring Boot-based administrative application with a file storage system. The storage upload and download endpoints are missing permission checks, allowing any logged-in user to upload arbitrary files and any unauthenticated person to download them using predictable file identifiers. This enables storage abuse, unauthorized file distribution, and data exposure within organizations using this system.
Technical details
The vulnerability is an authorization bypass in the file storage endpoints (/storage/upload, /storage/fetch/**, /storage/download/**) of cjbi admin3 v3.0.0. The POST /storage/upload endpoint lacks the @RequiresPermissions annotation that protects other storage endpoints, allowing any authenticated user—even those with zero permissions—to upload files. Additionally, the login interceptor explicitly whitelists fetch and download paths, making them accessible without authentication. The DELETE /storage/files/{key} endpoint also lacks permission checks. Attackers can upload malicious files and any anonymous user can retrieve them using enumerable keys (5-char-random prefix + filename pattern), leading to storage abuse and data disclosure. The vulnerability requires either a valid login token (for upload/delete) or no authentication (for download).
Affected products
- cjbi admin3 v3.0.0
Timeline
- 2026-08-28: disclosed