TDuckCloud tduck-platform Vertical Privilege Escalation Vulnerability

A critical vertical privilege escalation vulnerability has been identified in TDuckCloud tduck-platform versions through 5.1. The issue resides in the AuthorizationInterceptor component, specifically within the preHandle function. This vulnerability allows attackers with normal user accounts to bypass authorization checks and access sensitive management APIs under the /manage/ path, which should be restricted to administrators. The flaw can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized access to management APIs, enabling normal users to perform actions or access resources intended for administrators.

Reproduction

To reproduce this vulnerability, log in as a normal user and attempt to access a management API, such as the user management endpoint. This will result in an authorization error. However, injecting a semicolon into the request path can bypass the authorization check and grant access to the API.