Description
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dromara | Jpom | ≤ 2.11.12 | — |
References
- GitHub Issue #115 issue-tracking exploit
- BuildInfoController.branchList at v2.11.12 technical-description
- https://github.com/dromara/Jpom product
- VulnCheck Advisory: Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list third-party-advisory