Authorization Bypass in yshop-crm CrmCustomerController

yshop-crm versions up to and including 2.1.3 contain a critical authorization flaw within the CrmCustomerController. The application fails to enforce proper access control checks on the saveRedisSet and getRedisSet endpoints. This vulnerability allows any user with authenticated back-office access to perform unauthorized read and write operations on critical Redis keys. These keys govern installation-wide business logic, specifically lead-allocation and customer auto-recycling policies. By manipulating these settings, an attacker can disrupt the core functionality of the CRM, leading to the deletion of customer records, the disabling of lead recycling mechanisms, or a denial-of-service state that prevents the creation of new customers across the entire deployment. Defenders should prioritize auditing logs for unauthorized access to these specific administrative endpoints.

Impact

Successful exploitation of this vulnerability allows unauthorized modification of business-critical CRM settings. The primary impact includes the potential for mass deletion of customer data, prolonged business process disruption through the disabling of lead recycling, and an application-wide denial-of-service condition where customer creation becomes impossible. The scope of impact is limited to the CRM's internal data and business operations but poses a significant risk to organizational data integrity and service availability.

Recommendation

Prioritized, concrete actions for security operations and IT teams:

• Immediately audit application logs for frequent or unauthorized HTTP POST/GET requests directed at the saveRedisSet and getRedisSet endpoints within the CrmCustomerController.
• Implement strict role-based access control (RBAC) validation for administrative CRM functions to prevent non-privileged users from interacting with backend controller logic.
• Monitor Redis-related application calls for unexpected key modifications that deviate from standard administrative workflows.
• If a patch becomes available for yshop-crm, prioritize testing and deployment to all production instances immediately.