Radar Incorrect Access Control Vulnerability Allowing Authentication Bypass

An authentication bypass vulnerability has been identified in Radar version 1.0.8. This issue allows attackers to access sensitive APIs without a token by exploiting incorrect access control in the application's authentication interceptor. The vulnerability arises because the interceptor's request URI handling can be manipulated to bypass authentication checks.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive APIs, potentially leading to exposure of confidential data or functionality.

Reproduction

To reproduce this vulnerability, send a request to the '/services/user/login/../../v1/datalist/1' endpoint. The authentication check will be bypassed, granting access to the data without a valid token.