itwanger paicoding Permissive Cross-Domain Policy Vulnerability in Versions 1.0.0 through 1.0.3

A vulnerability exists in itwanger paicoding versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3, related to the CrossUtil.java file. The issue arises because the application's Cross-Origin Resource Sharing (CORS) policy is overly permissive, allowing untrusted domains to make authenticated cross-origin requests. This vulnerability could lead to unauthorized access to sensitive information.

Impact

Exploitation of this vulnerability allows for unauthorized cross-origin requests to be made from malicious domains, potentially leading to the exfiltration of sensitive data from the user's session.

Reproduction

To reproduce this vulnerability, log into the application and send a request to the vulnerable API endpoint '/admin/user/info' from a domain that is not trusted. The response will include sensitive user information, demonstrating the impact of the permissive cross-domain policy.