gin-vue-admin background arbitrary code coverage vulnerability
Date: 2024-04
Affected: go/github.com/flipped-aurora/gin-vue-admin/server
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-31457
CWE: CWE-22
CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H)

### Impact "gin-vue-admin<=v2.6.1 has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter." Affected code: https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sys_auto_code.go:239. Let's take a look at the method 'AutoPlug' within the 'AutoCodeApi' struct. ```go func (autoApi *AutoCodeApi) AutoPlug(c *gin.Context) { var a system.AutoPlugReq err := c.ShouldBindJSON(&a) if err != nil { response.FailWithMessage(err.Error(), c) return } a.Snake = strings.ToLower(a.PlugName) a.NeedModel = a.HasRequest || a.HasResponse err = autoCodeService.CreatePlug(a) if err != nil { global.GVA_LOG.Error("预览失败!", zap.Error(err)) response.FailWithMessage("预览失败", c) return } response.Ok(c) } ``` The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. ```go type AutoPlugReq struct { PlugName string `json:"plugName"` // 必然大写开头 Snake string `json:"snake"` // 后端自动转为 snake RouterGroup string `json:"routerGroup"` HasGlobal


Mitigations:

Architectural layers (MAESTRO):