Authentication Bypass in IceCMS via Shiro JWT Filter Misconfiguration

IceCMS versions up to and including 4.1.5 contain a critical missing authentication vulnerability arising from an improper configuration of the Apache Shiro JWT filter. The application incorrectly excludes the /User/ URL path from authentication requirements, which facilitates unauthorized access to administrative functions.

Attackers can exploit this flaw by sending unauthenticated PUT requests to the /User/updateUser endpoint. This vulnerability permits the modification of any user account identified by its userId. An attacker can leverage this to reset passwords or escalate privileges by assigning administrative roles to arbitrary user accounts, resulting in full account takeover. The vulnerability carries a CVSS v3.1 base score of 9.8, necessitating immediate attention for any organizations hosting instances of IceCMS.

Impact

Successful exploitation of this vulnerability results in full account takeover, allowing attackers to modify, delete, or disable any account within the IceCMS system. By resetting passwords and elevating privileges for arbitrary user IDs, unauthorized actors can gain complete administrative control over the application, leading to unauthorized data access, system configuration changes, and potential exfiltration or destruction of sensitive information stored within the CMS.

Recommendation

• Upgrade to a patched version of IceCMS immediately.
• Review all administrative accounts for suspicious modification timestamps or role changes occurring after the date of this disclosure.
• Inspect server access logs for anomalous PUT requests directed to the /User/updateUser endpoint originating from untrusted network sources.
• If immediate patching is not possible, apply a temporary WAF rule to block or challenge all incoming requests to the /User/ directory that do not possess a valid authentication token.