Description
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WuKongOpenSource | Wukong_HRM | — | — |
References
- Researcher Proof of Concept (payslip read) exploit
- Researcher Proof of Concept (employee export) exploit
- Researcher Proof of Concept (attachment download) exploit
- Vulnerable Code: ParamAspect (commit 186115e) technical-description
- Vulnerable Code: EmployeeAspect (commit 186115e) technical-description
- VulnCheck Advisory: Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect third-party-advisory