Springblade
Monthly
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
Improper authorization in SpringBlade up to 5.0.1 allows an authenticated remote user to access role or user detail records they do not own by manipulating the ID parameter in the RoleController User Detail endpoint. The flaw is a CWE-285 improper authorization issue (insecure direct object reference) that affects only confidentiality, with no integrity or availability impact and no code execution; publicly available exploit code exists, and no CISA KEV listing is present. The independent assessment rates this as a moderate, not urgent, priority, and notes that while the CVSS vector indicates high privileges (PR:H), the practical privilege level may be lower because any logged-in user could likely exploit the IDOR.
Improper authorization in the SpringBlade Java microservice framework (all versions up to 5.0.1) lets an authenticated user holding high privileges manipulate the initPassword argument exposed by the Parameter Submit Management controller (ParamController) and change system parameters they should not be able to control. The endpoint is remotely reachable, but exploitation requires an existing elevated session with no user interaction, and the assessed impact is LOW across confidentiality, integrity and availability (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the project has not responded to the issue report, so no vendor-released patch is available at time of analysis.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user data and escalate privileges. PoC available.
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through the authentication routing mechanism.
A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
Improper authorization in SpringBlade up to 5.0.1 allows an authenticated remote user to access role or user detail records they do not own by manipulating the ID parameter in the RoleController User Detail endpoint. The flaw is a CWE-285 improper authorization issue (insecure direct object reference) that affects only confidentiality, with no integrity or availability impact and no code execution; publicly available exploit code exists, and no CISA KEV listing is present. The independent assessment rates this as a moderate, not urgent, priority, and notes that while the CVSS vector indicates high privileges (PR:H), the practical privilege level may be lower because any logged-in user could likely exploit the IDOR.
Improper authorization in the SpringBlade Java microservice framework (all versions up to 5.0.1) lets an authenticated user holding high privileges manipulate the initPassword argument exposed by the Parameter Submit Management controller (ParamController) and change system parameters they should not be able to control. The endpoint is remotely reachable, but exploitation requires an existing elevated session with no user interaction, and the assessed impact is LOW across confidentiality, integrity and availability (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the project has not responded to the issue report, so no vendor-released patch is available at time of analysis.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user data and escalate privileges. PoC available.
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through the authentication routing mechanism.
A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.