Description
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lenve | vhr | — | — |
References
- Researcher Advisory third-party-advisory
- Vulnerable Code: ChatController.java at 03abbd3 technical-description
- HrMapper.xml at 03abbd3 technical-description
- Hr.java at 03abbd3 technical-description
- https://github.com/lenve/vhr product
- VulnCheck Advisory: vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs third-party-advisory