Zhisheng17 Blog Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in Zhisheng17 Blog version 3.0.1-SNAPSHOT. This vulnerability allows attackers to access the '/admin/' API without a token. The issue arises in the 'BaseInterceptor' class, specifically within the 'preHandle' method, where the request URI is not properly validated. Attackers can exploit this by manipulating the URI to bypass authentication and access restricted resources.

Impact

Exploitation of this vulnerability allows for unauthorized access to admin APIs, potentially leading to unauthorized actions such as deleting comments.

Reproduction

To reproduce this vulnerability, send a request to the '/admin/comments/delete' endpoint without an authentication token. The server will respond with a redirect to the login page. However, if the request URI is modified to include '../' to bypass the interceptor's checks, access to the endpoint will be granted, allowing for the deletion of comments.