Xinguan Incorrect Access Control Vulnerability in User Management API

A vulnerability allowing incorrect access control has been identified in Xinguan version 0.0.1-SNAPSHOT. This issue arises in the '/system/user/findUserList' API, where authentication requirements can be bypassed, allowing attackers to access sensitive information by sending a crafted payload.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information via the affected API.

Reproduction

To reproduce this vulnerability, send a GET request to the '/system/user/findUserList' API. The request must include a valid 'JSESSIONID' cookie to pass the initial authentication check. This request will be denied due to authentication requirements. However, by sending a request to '/static;/../system/user/findUserList', the authentication can be bypassed, granting access to the sensitive user information.