Novel-Plus Improper Authorization Vulnerability in Log Deletion Function

A critical vulnerability has been identified in Novel-Plus versions up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. The issue arises in the LogController.java file, specifically within the deleteIndex function. This vulnerability allows for improper authorization, enabling remote attackers to delete system logs without proper permission.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of system logs, which could disrupt auditing and monitoring processes.

Reproduction

To reproduce this vulnerability, send a POST request to the '/common/log/remove' endpoint with an 'id' parameter specifying the log entry to be deleted. This request can be made remotely, and the absence of proper authorization checks allows the deletion to occur without the necessary permissions.