Authentication Bypass in WIMOOR via Unsigned X-USERINFO Header

WIMOOR through commit ec86736 is susceptible to an authentication bypass vulnerability. The flaw exists because the application incorrectly processes the unsigned 'X-USERINFO' HTTP header when backend service ports are accessed directly, bypassing the intended gateway or proxy authentication mechanisms. By manipulating the 'companyid', 'manager', or 'admin' fields within this header, an unauthenticated attacker can successfully impersonate any tenant, including administrative accounts. This flaw allows unauthorized actors to read and modify sensitive internal information, including order histories, financial records, and Amazon seller authorizations. This represents a significant risk to organizations using WIMOOR, particularly if backend instances are reachable from untrusted network segments.

Impact

Successful exploitation allows for full tenant impersonation and unauthorized access to sensitive business operations. Attackers can view or manipulate financial data, modify order processing, and compromise third-party integrations such as Amazon seller authorizations, potentially leading to significant financial loss and operational disruption for users of the platform.

Recommendation

• Immediately restrict network access to WIMOOR backend service ports to ensure all traffic must traverse the authorized gateway, preventing direct access.
• Patch WIMOOR by updating to a version beyond commit ec86736, ensuring that the application validates the authenticity of 'X-USERINFO' headers instead of relying on client-provided data.
• Review web application firewall (WAF) logs for any incoming requests containing custom 'X-USERINFO' headers, which should be considered anomalous if originating from external or non-internal-gateway IP addresses.