itranswarp Authentication Bypass Vulnerability in the Management Component

An authentication bypass vulnerability has been identified in itranswarp version 2.19. This issue allows attackers to access the '/manage/' component without a valid token by sending a crafted request. The vulnerability arises because the authorization check only verifies if the request URI starts with '/manage/', without filtering special characters. As a result, attackers can manipulate the URI to bypass authentication and gain unauthorized access.

Impact

Exploitation of this vulnerability allows for unauthorized access to the management component, bypassing authentication requirements.

Reproduction

To reproduce this vulnerability, send a request to the '/manage;/setting/website' endpoint. The absence of token validation for this URI will result in unauthorized access, demonstrating the authentication bypass.