Missing Authorization in Makunet maku-boot Configuration Endpoints

Makunet maku-boot versions 4.3.0 through 5.0.0 contain a critical missing authorization vulnerability. The application fails to perform necessary authority checks on specific system configuration endpoints, specifically '/sys/mail/config/list' and '/sys/sms/config/list'. This oversight allows any authenticated user to interact with these sensitive API routes.

By exploiting this flaw, an attacker can retrieve unmasked SMTP credentials and administrative access keys for major cloud service providers including Aliyun, Tencent Cloud, Qiniu, and Huawei Cloud. Furthermore, the vulnerability allows unauthorized access to the '/sys/mail/config/send' endpoint, which can be manipulated to trigger outbound mail to arbitrary recipients. This represents a significant risk for credential theft, lateral movement via cloud service abuse, and the facilitation of phishing or spam campaigns originating from the compromised host's mail infrastructure.

Impact

The vulnerability poses a high risk to organizations utilizing maku-boot, specifically regarding the exposure of cloud service provider access keys and internal email infrastructure. Successful exploitation allows for the exfiltration of sensitive configuration data, enabling further compromise of associated cloud environments and the potential for mass unauthorized messaging. No specific victim counts have been reported, but the broad scope of affected cloud providers significantly increases the blast radius for affected enterprise users.

Recommendation

• Immediately upgrade Makunet maku-boot to a version addressing this missing authorization vulnerability.
• Audit access logs for any requests directed to '/sys/mail/config/' or '/sys/sms/config/' endpoints to identify potential unauthorized reconnaissance or exploitation attempts.
• Rotate all SMTP credentials and cloud access keys (Aliyun, Tencent Cloud, Qiniu, Huawei Cloud) that were stored within the maku-boot configuration.
• Restrict network access to the application management interface to trusted administrative subnets only.