CVE-2024-57434: Mall-tiny Auth Bypass Vulnerability

CVE-2024-57434 Overview

CVE-2024-57434 is an incorrect access control vulnerability in macrozheng mall-tiny version 1.0.1. The project ships with a default set of imported users, and the built-in test account is granted super administrator privileges. Any attacker who obtains or guesses the default test credentials gains full administrative control over the application. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
An authenticated user with default test credentials receives super administrator rights, enabling full compromise of confidentiality, integrity, and availability of the mall-tiny deployment.

Affected Products

macrozheng mall-tiny 1.0.1
Deployments derived from the default mall-tiny user import
Development or demo instances exposed to untrusted networks

Discovery Timeline

2025-01-31 - CVE-2024-57434 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-57434

Vulnerability Analysis

The mall-tiny project is a lightweight Spring Boot e-commerce learning framework maintained by macrozheng. On startup, it imports a fixed set of demonstration users into the database. One of those seeded accounts, intended as a test user, is assigned the super administrator role.

Because the credentials are documented and identical across every deployment, authentication offers no protection. An attacker who knows the default username and password authenticates as a low-privilege user in appearance but receives the highest role in the system. This is an authorization boundary failure rather than an authentication bypass.

Successful exploitation grants full read and write access to product, order, and user management endpoints, including the ability to create additional privileged accounts.

Root Cause

The root cause is an insecure default configuration combined with improper authorization. The application's seed data assigns the super administrator role to a well-known test account. No first-run workflow forces credential rotation or role reassignment, so production and demo systems inherit the same over-privileged identity.

Attack Vector

Exploitation requires network access to the mall-tiny HTTP API and knowledge of the default test credentials, which are publicly documented in the project's repository. The attacker authenticates against the login endpoint, receives a JWT session token, and then invokes administrative REST endpoints such as user management, role assignment, and menu configuration APIs. See the GitHub Weak Password Analysis for a walkthrough of the request sequence.

Detection Methods for CVE-2024-57434

Indicators of Compromise

Successful login events for the default test username on /admin/login endpoints
Creation of new administrator accounts shortly after a test-user authentication
Unexpected role or permission modifications through /role/* or /menu/* API paths
JWT tokens issued to the seeded test account being used from external IP addresses

Detection Strategies

Audit the ums_admin and ums_admin_role_relation tables for the default test account still holding the super administrator role
Alert on any authentication attempt using known default mall-tiny usernames
Inspect application access logs for administrative REST calls originating from non-administrator source IPs

Monitoring Recommendations

Forward Spring Boot application logs and access logs to a centralized SIEM or data lake for correlation
Build dashboards that track privileged API usage per account and flag deviations from baseline
Monitor outbound traffic from application servers for signs of data exfiltration following administrative access

How to Mitigate CVE-2024-57434

Immediate Actions Required

Remove or disable the default test account seeded by mall-tiny on every deployment
Rotate credentials for all imported demo users and enforce strong passwords
Revoke super administrator role assignments from any non-operational account
Restrict administrative endpoints to trusted networks or VPN-only access until remediation is complete

Patch Information

No vendor patch is listed in the NVD entry for CVE-2024-57434. mall-tiny is positioned as a learning project rather than a production framework. Operators must treat the default user import as insecure and modify the initialization SQL scripts before deployment. Refer to the GitHub Weak Password Analysis for details on the affected seed data.

Workarounds

Edit the project's initialization SQL to remove the test user or downgrade its role before first startup
Add a post-deployment script that disables any account matching default mall-tiny usernames
Place mall-tiny behind an authenticating reverse proxy that blocks known default credentials at the edge
Do not expose mall-tiny instances to the public internet; treat the codebase as demonstration software only

bash

# Example: disable the default super administrator test account in MySQL
mysql -u root -p mall <<'SQL'
UPDATE ums_admin SET status = 0 WHERE username = 'test';
DELETE FROM ums_admin_role_relation
  WHERE admin_id IN (SELECT id FROM ums_admin WHERE username = 'test');
SQL