Missing Authentication Vulnerability in fuint API

The fuint platform, specifically versions up to commit 4c4bc8a, contains a critical missing authentication vulnerability within its client API. This flaw allows unauthenticated remote attackers to bypass access controls by omitting the required Access-Token header when querying the /clientApi/order/detail endpoint. By systematically enumerating sequential orderId values, an attacker can extract sensitive customer data associated with orders. The exposed information includes personally identifiable information (PII) such as full names, national ID numbers, phone numbers, physical addresses, WeChat openIds, and authentication verification codes. Because the vulnerability relies on predictable, sequential identifiers, the impact is significant, as an attacker can automate the retrieval of records across the entire customer database without requiring prior authorization or specific target knowledge.

Impact

The vulnerability results in a massive unauthorized disclosure of PII for the organization's user base. Successful exploitation leads to the breach of sensitive data, including national IDs and contact details, posing significant legal and regulatory risks. The exposure of WeChat openIds and verification codes further facilitates downstream account takeover or social engineering attacks against the platform's customers.

Recommendation

Prioritize the immediate audit of all publicly accessible API endpoints within the fuint application to ensure proper authentication middleware enforcement.

• Update the fuint platform to a version released after commit 4c4bc8a that implements mandatory authentication for the /clientApi/order/detail endpoint.
• Monitor web server logs for a high volume of requests to the /clientApi/order/detail endpoint originating from a single IP address with empty or missing authorization tokens.
• Analyze access logs for anomalous, sequential orderId patterns, which are indicative of an automated enumeration attack targeting this vulnerability.