Qinglong Timed Task Management Platform Authentication Bypass Vulnerability Allowing Credential Reset

An authentication bypass vulnerability has been identified in the Qinglong timed task management platform, prior to version 2.20.1. The issue arises in the init guard middleware, which fails to properly validate the '/open/user/init' path. This oversight allows an unauthenticated attacker to send a PUT request to '/open/user/init' and reset administrator credentials on an initialized instance. The vulnerability exists because the '/open/*' paths are whitelisted from JWT authentication and are rewritten to '/api/user/init' after the guard has already been bypassed.

Impact

Exploitation of this vulnerability allows an unauthenticated attacker to reset admin credentials on an initialized Qinglong panel instance, thereby gaining full administrative access. This access enables the execution of arbitrary cron jobs and scripts on the server.

Reproduction

To reproduce this vulnerability, clone the Qinglong repository and check out a commit prior to the fix. Then, send a PUT request to '/open/user/init' with new credentials. The init guard will not block the request, allowing the credentials to be reset.

Remediation

Users can update to Qinglong version 2.20.1 or later, where this vulnerability has been fixed.