T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/optimized-start-win.py:620- Finding
Universal Password Authentication Bypass and Forgeable Access Tokens
- Content
View full analysis
login(@RequestBody Map loginData) { String username = loginData.get("username"); String password = loginData.get("password"); Map result = new HashMap<>(); LambdaQueryWrapper wrapper = new LambdaQueryWrapper<>(); wrapper.eq(SysUser::getUsername, username); SysUser user = sysUserService.getOne(wrapper); if (user == null || (!password.equals("123456") && !password.equals(user.getPassword()))) { result.put("code", 401); result.put("message", "用户名或密码错误"); return result; } String token = "token-" + user.getId() + "-" + System.currentTimeMillis(); result.put("code", 200); result.put("message", "登录成功"); Map data = new HashMap<>(); data.put("token", token); data.put("username", user.getUsername()); data.put("realName", user.getRealName()); result.put("data", data); return result; } @GetMapping("/info") public Map info(@RequestHeader("Authorization") String authHeader) { Map result = new HashMap<>(); if (authHeader == null || !authHeader.startsWith("Bearer ")) { result.put("code", 401); result.put("message", "未登录"); return result; } result.put("code", 200); result.put("message", "success"); Map data = new HashMap<>(); data.put("roles", new String[]{"admin"}); data.put("name", "管理员"); result.put("data", data); return result; } ``` ### Technical Analysis The generated login controller treats the literal password `123456` as valid for every existing user. The password comparison also directly compares supplied plaintext with the stored ...[truncated 1439 chars]- Remediation
View remediation