Vulnerability in jingsewu open-wes

[ Description ]Official description

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/jingsewu/open-wes/blob/v1.0.0/server/modules-gateway/gateway-core/src/main/j…
• github.com/jingsewu/open-wes/blob/v1.0.0/server/modules-wes/wes-stock/src/main/java/org…
• hackmd.io/@hieuPenguinnn/open-wes-gateway-missing-warehouse-scope-authz
• www.vulncheck.com/advisories/open-wes-through-1.0.0-broken-access-control-via-globalgat…