A missing authorization vulnerability in zlt2000 microservices-platform allows authenticated users to bypass permission checks and access sensitive administrative functions.

The application incorrectly defaults the security configuration flag zlt.security.auth.urlPermission.enable to false, which results in the complete bypass of URL-based authorization checks for authenticated users. An attacker with a low-level authenticated session can invoke restricted administrative endpoints, such as user management, role assignment, and Elasticsearch index operations, without the required permissions.

The ability for unprivileged users to access and manipulate administrative APIs poses a severe risk to the entire platform. Successful exploitation could lead to full administrative account takeover, unauthorized data modification or deletion, and the destruction of critical system indices, resulting in significant service disruption and loss of data integrity. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate remediation.

Immediate Action: Update to a version where the zlt.security.auth.urlPermission.enable flag is set to true by default, or manually modify the application.yml configuration file to set zlt.security.auth.urlPermission.enable: true and restart the services.

Proactive Monitoring: Review system access logs for anomalous API requests originating from standard user accounts, specifically monitoring for activity directed at user management, role assignment, and Elasticsearch administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to sensitive administrative URL paths, ensuring that only trusted IP addresses or specific authorized roles can interact with these endpoints until the configuration is corrected.

Public Exploit Available: Yes, a series of published proof-of-concept scripts exist on GitHub, as documented in the referenced security research.

This vulnerability presents a significant security risk due to the ease with which administrative controls can be bypassed. Administrators must prioritize the modification of the zlt.security.auth.urlPermission.enable configuration to ensure that authorization checks are actively enforced. Failure to address this configuration flaw leaves the platform susceptible to full administrative compromise by any authenticated user.