jeewx-boot Authentication Bypass Vulnerability in Login Interceptor

An authentication bypass vulnerability has been identified in jeewx-boot version 1.3. The issue arises in the LoginInterceptor class, specifically within the preHandle function. The vulnerability allows attackers to access certain API endpoints without a valid authentication token by exploiting how request paths are processed.

Impact

Exploitation of this vulnerability allows unauthorized access to protected API endpoints, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, send a request to the '/system/back/jwSystemUser/list.do' endpoint without an authentication token. The request will be redirected to the login page. However, if the request path is modified to include a semicolon, the authentication check can be bypassed, allowing access to user information without a token.