CVE-2024-13211: Singmr Houserent Authentication Bypass Flaw

CVE-2024-13211 Overview

CVE-2024-13211 is an improper access control vulnerability in SingMR HouseRent 1.0, an open-source house rental application. The flaw exists in the AdminController.java file located at src/main/java/com/house/wym/controller/. Attackers can exploit this issue remotely over the network with low privileges. A public exploit disclosure exists, increasing the risk of opportunistic attacks against exposed instances. The weakness is tracked under CWE-266: Incorrect Privilege Assignment.

Critical Impact
Remote authenticated attackers can bypass administrative access controls to affect confidentiality, integrity, and availability of the HouseRent application.

Affected Products

SingMR HouseRent 1.0
Component: AdminController.java administrative endpoint handlers
Deployments exposing the application over the network

Discovery Timeline

2025-01-09 - CVE-2024-13211 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13211

Vulnerability Analysis

The vulnerability resides within administrative functionality implemented in AdminController.java. HouseRent fails to enforce proper authorization checks on controller endpoints intended for privileged users. A low-privileged authenticated user can manipulate requests to reach administrative actions that should require elevated roles.

Because the attack vector is network-based and complexity is low, exploitation only requires an accessible instance and valid low-tier credentials. The public disclosure of exploit details on VulDB and GitHub reduces the effort required to weaponize the flaw.

Root Cause

The root cause is missing or improperly implemented role-based access control in the Spring MVC controller layer. HouseRent's AdminController methods do not validate that the requesting principal holds an administrator role before executing sensitive operations. The application relies on client-side or path-level assumptions rather than server-side authorization enforcement, aligning with CWE-266.

Attack Vector

An attacker authenticates as a standard user, then issues direct HTTP requests to administrative routes exposed by AdminController. Without server-side privilege checks, the controller executes the requested action. The vulnerability description in the GitHub Issue #12 documents the affected functionality and public proof-of-concept references.

No verified code examples are available. See the VulDB entry #290816 and the upstream GitHub issue for the disclosed technical details.

Detection Methods for CVE-2024-13211

Indicators of Compromise

Unexpected HTTP requests from non-administrative sessions to routes handled by AdminController.
Application logs showing successful administrative actions performed by low-privileged user accounts.
Unauthorized changes to rental listings, user records, or administrative configuration items.

Detection Strategies

Instrument application logging to capture the authenticated principal, requested URI, and HTTP method for every controller invocation.
Compare user role attributes against the controller path accessed to identify authorization mismatches.
Review web server access logs for direct requests to admin URIs originating from standard user sessions.

Monitoring Recommendations

Forward HouseRent application and access logs to a centralized SIEM for correlation and long-term retention.
Alert on spikes in requests to admin endpoints or on any admin action performed outside a known administrator identity.
Track anomalous session behavior, such as a single account accessing both user and admin functionality within short windows.

How to Mitigate CVE-2024-13211

Immediate Actions Required

Restrict network access to HouseRent instances using firewall rules or reverse-proxy allowlists until a fix is applied.
Audit all existing user accounts and revoke unnecessary privileges.
Review historical logs for evidence of unauthorized administrative activity.

Patch Information

No vendor advisory or official patch is listed in the enriched CVE data. Administrators should monitor the SingMR HouseRent GitHub repository for upstream fixes and apply them once available. Until a patch is released, treat all exposed instances as vulnerable.

Workarounds

Add server-side role verification to every method in AdminController.java, using Spring Security annotations such as @PreAuthorize("hasRole('ADMIN')").
Place the application behind an authenticating reverse proxy that enforces path-based restrictions on /admin/* routes.
Disable or remove exposed administrative endpoints if they are not required for the deployment.

bash

# Example nginx configuration to restrict admin paths to trusted IPs
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://houserent_backend;
}