CVE-2024-12235: Tongzhouyun Agilebpm Auth Bypass Vulnerability

CVE-2024-12235 Overview

CVE-2024-12235 is an improper access control vulnerability in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to version 1.0.0. The flaw resides in the doFilter function of AuthorizationTokenCheckFilter.java, located in the ab-auth-spring-security-oauth2 module. Authenticated attackers can bypass authorization checks over the network to access resources reserved for higher-privileged users. The vulnerability maps to [CWE-266: Incorrect Privilege Assignment] and enables vertical privilege escalation. Exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Remote attackers with low privileges can bypass token-based access controls in AgileBPM and reach restricted endpoints, exposing confidentiality, integrity, and availability of business process data.

Affected Products

Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0
Component: ab-auth/ab-auth-spring-security-oauth2 authorization filter
File: AuthorizationTokenCheckFilter.java (doFilter function)

Discovery Timeline

2024-12-05 - CVE-2024-12235 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12235

Vulnerability Analysis

AgileBPM relies on AuthorizationTokenCheckFilter to validate OAuth2 tokens and enforce access decisions on incoming HTTP requests. The doFilter method fails to correctly evaluate the caller's privileges before dispatching the request to downstream handlers. As a result, a low-privileged authenticated user can craft requests that reach administrative or otherwise restricted endpoints. The condition is classified as vertical overreach, meaning a standard user gains functionality intended for higher-privileged accounts. Public analysis of the issue is available in the GitHub RCE Analysis.

Root Cause

The root cause is an incorrect authorization decision inside the filter chain. Instead of enforcing role or scope checks against the target resource, the filter accepts any valid token and forwards the request. This aligns with [CWE-266], where privileges assigned to a subject exceed what the business logic intends. The design of the Spring Security OAuth2 integration in AgileBPM does not couple token validity with resource-level authorization.

Attack Vector

Exploitation occurs over the network and requires only a low-privileged account on the target instance. The attacker sends HTTP requests to endpoints that should be restricted to administrators or other elevated roles. Because the filter approves the request based on token presence rather than granted authorities, the backend controller executes the action. No user interaction is required, and the attack complexity is low. See the VulDB entry for additional metadata.

No verified proof-of-concept code is provided in the enriched dataset; refer to the GitHub RCE Analysis for the disclosed technical walk-through.

Detection Methods for CVE-2024-12235

Indicators of Compromise

Access log entries showing standard user accounts issuing requests to administrative AgileBPM paths such as user management, workflow definition, or system configuration endpoints.
Repeated HTTP 200 responses from restricted routes for tokens associated with low-privileged roles.
Unexpected changes to business process definitions, roles, or user assignments made by non-administrator accounts.

Detection Strategies

Correlate OAuth2 token subject claims against the target endpoint's required role and alert when mismatches produce successful responses.
Instrument AuthorizationTokenCheckFilter with logging that captures principal authorities and the resolved request path for each decision.
Deploy application-layer rules that enumerate sensitive AgileBPM routes and flag calls from users lacking administrative scopes.

Monitoring Recommendations

Forward AgileBPM application, access, and audit logs to a centralized SIEM for correlation across sessions.
Baseline per-role endpoint usage and alert on deviations, particularly access to configuration or user-management APIs by non-administrators.
Monitor for horizontal enumeration patterns such as rapid iteration over object identifiers in workflow or form APIs.

How to Mitigate CVE-2024-12235

Immediate Actions Required

Restrict network exposure of AgileBPM instances by placing them behind a VPN or IP allow list until a fix is applied.
Audit existing accounts and revoke tokens for any user whose activity indicates attempted access to restricted endpoints.
Add a reverse-proxy authorization layer that enforces role checks on administrative URL prefixes as a compensating control.

Patch Information

No vendor advisory or official patch is referenced in the enriched CVE data. Organizations running AgileBPM 1.0.0 should contact Shenzhen Dashi Tongzhou Information Technology for remediation guidance and monitor the VulDB record for updates. Until an official patch is available, apply the workarounds below.

Workarounds

Modify AuthorizationTokenCheckFilter.doFilter to enforce role and scope checks against the requested resource using Spring Security's HttpSecurity authorization rules.
Configure method-level security with @PreAuthorize annotations on controllers exposing administrative or sensitive functionality.
Segment low-privileged user traffic from administrative APIs at the network or gateway layer, denying access to /admin/** style routes for non-administrator roles.

bash

# Example Spring Security configuration enforcing role checks on sensitive routes
http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**", "/sys/**").hasRole("ADMIN")
    .requestMatchers("/api/workflow/definition/**").hasAuthority("SCOPE_workflow.admin")
    .anyRequest().authenticated()
  )
  .oauth2ResourceServer(oauth2 -> oauth2.jwt());