Gowabby HFish Improper Authentication Vulnerability in LoadUrl Function

A critical permission bypass vulnerability has been identified in Gowabby HFish version 0.1. The issue arises in the LoadUrl function within the file view/url.go, where the authentication process is not properly implemented. This flaw allows remote attackers to bypass authentication requirements. The vulnerability has been publicly disclosed and is available for exploitation.

Impact

Exploitation of this vulnerability allows for unauthorized access to functionalities or areas of the application that require authentication, potentially leading to further actions or access within the application.

Reproduction

To reproduce this vulnerability, send a GET request to the /dashboard endpoint. Include a Cookie header with is_login set to admin. The absence of proper authentication will allow access to the dashboard, bypassing normal login requirements.