Missing Authorization in NovelPlus Book Download Endpoint (CVE-2020-NOVELPLUS-09) with PoC

漏洞关键信息总结 漏洞概述 漏洞名称：CVE-2020-NOVELPLUS-09-Book-Download-Missing-Authorization 漏洞类型：缺失授权（Missing Authorization） 漏洞描述： 模拟了八种基于请求的处理方法； 是其中之一。 端点允许无权限会话（zero-permission session）导出完整文件——包括每一章和每一页。会话以无权限状态启动，但带注释的列表端点拒绝该会话。导出会绕过所有分页、数据范围和速率限制，将管理端点的其余部分暴露出来。 影响范围 受影响组件： 模块中的 的 端点 影响：未授权用户可下载完整书籍文件（含所有章节和页面），绕过分页、数据范围和速率限制 触发条件：使用无权限会话（zero-permission session）调用 端点 修复方案 在 端点添加权限校验，确保只有具备相应权限的用户才能访问 对导出操作增加速率限制和数据范围控制 对无权限会话返回 状态码 POC 代码 `` download` is one of them. A session with zero permission bits therefore exports a complete file -- every chapter and page. A session with zero permission bits therefore exports a complete file -- every chapter and page. The annotated listing endpoint refuses that same session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expe

目標達成すべての支援者に感謝 — 100%達成しました！

Missing Authorization in NovelPlus Book Download Endpoint (CVE-2020-NOVELPLUS-09) with PoC

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Missing Authorization in NovelPlus Book Download Endpoint (CVE-2020-NOVELPLUS-09) with PoC

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！