In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system.
The /api/admin/sys-token/page API endpoint, available in the system management module, does not enforce access control based on user role. It is sufficient for the caller to have a valid session (completed login) to receive a response containing plaintext authentication tokens of all currently logged-in users. An attacker can use the obtained administrator token to impersonate the administrator account and perform actions with full administrative privileges without knowing the password.
An attacker with any user account can obtain an administrator token and completely take over the system, performing operations with the highest privileges, including configuration modification, data access, and user management.
Apply patches available from the vendor according to the references. As a temporary measure, it is recommended to restrict access to the /api/admin/sys-token/page endpoint exclusively to users with the administrator role at the server configuration or firewall level, and to review and invalidate currently issued tokens.
Pig4Cloud Pig (pig-mesh/pig) version 3.8.2 and lower
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NPig4cloud Pig
APPPig4Cloud≤ 3.8.2