hope-boot Incorrect Access Control Vulnerability in User Edit Component

A vulnerability allowing authentication bypass has been identified in hope-boot version 1.0.0. This issue arises from incorrect access control in the '/user/edit/' component, which allows attackers to bypass authentication by sending a crafted GET request. The vulnerability is rooted in the use of an insecure version of Apache Shiro for authentication, leaving certain interfaces unprotected and exploitable.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized access to user-editing functionalities.

Reproduction

To reproduce this vulnerability, send a GET request to the '/user/edit/1' endpoint. Include the 'Host' header with the value 'localhost:8886' and the 'User-Agent' header indicating the use of Apifox 1.0.0. This request will bypass authentication and gain access to the user edit interface.