CVE-2020-19005 (Java, published 2020-08-25T22:15Z)
Description: value: zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file directly.
Severity: LOW (CVSS v3 base score: 5.7)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/94fzb/zrlog
Files changed:
common/src/main/java/com/zrlog/web/util/PluginHelper.java
pom.xml
service/src/main/java/com/zrlog/service/UploadService.java
web/src/main/java/com/zrlog/web/handler/PluginHandler.java
Commit message: Fix #48 forget remove token from ThreadLocal


Vulnerable code:
package com.zrlog.service;
import com.jfinal.core.JFinal;
import com.zrlog.model.User;
    public static Map<String, String> genHeaderMapByRequest(HttpServletRequest request) {
        AdminTokenVO adminTokenVO = AdminTokenThreadLocal.getUser();
            User user = User.dao.findById(adminTokenVO.getUserId());
            map.put("LoginUserName", user.get("userName").toString());
        map.put("Blog-Version", ((Map) JFinal.me().getServletContext().getAttribute("zrlog")).get("version").toString());
                    , new HttpJsonArrayHandle<Map>(), PluginHelper.genHeaderMapByRequest(request)).getT();
import com.zrlog.service.PluginHelper;
                Map.Entry<AdminTokenVO, User> entry = adminTokenService.getAdminTokenVOUserEntry(request);
            httpResponse = httpUtil.sendGetRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request)).getT();
                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request)).getT();
                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri + "?" + request.getQueryString(), IOUtil.getByteByInputStream(request.getInputStream()), handle, PluginHelper.genHeaderMapByRequest(request)).getT();

Fixed code:
package com.zrlog.web.util;
import com.zrlog.util.BlogBuildInfoUtil;
    public static Map<String, String> genHeaderMapByRequest(HttpServletRequest request, AdminTokenVO adminTokenVO) {
        map.put("Blog-Version", BlogBuildInfoUtil.getVersion());
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.zrlog</groupId>
    <artifactId>zrlog</artifactId>
    <version>2.1.0</version>
    <modules>
        <module>web</module>
        <module>service</module>
        <module>common</module>
        <module>data</module>
    </modules>
    <packaging>pom</packaging>
    <name>zrlog</name>
    <description>ZrLog是使用Java开发的博客/CMS程序，具有简约，易用，组件化，内存占用低等特点。自带Markdown编辑器，让更多的精力放在写作上，而不是花费大量时间在学习程序的使用上。
    </description>
    <url>https://www.zrlog.com</url>

    <properties>
        <java.version>1.8</java.version>
        <jfinal.version>3.3</jfinal.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <servlet.version>3.1.0</servlet.version>
    </properties>

    <developers>
        <developer>
            <name>xiaochun</name>
            <email>xchun90@163.com</email>
            <url>http://blog.94fzb.com</url>
            <roles>
                <role>owner</role>
            </roles>
        </developer>
        <developer>
            <name>weekdragon</name>
            <email>790774717@qq.com</email>
            <url>https://www.weekdragon.cn</url>
            <roles>
                <role>developer</role>
            </roles>
        </developer>
        <developer>
            <name>e-lionel</name>
            <email>lionel0724@163.com</email>
            <url>https://github.com/e-lionel</url>
            <roles>
                <role>reporter</role>
            </roles>
        </developer>
    </developers>

    <issueManagement>
        <system>Github Issue</system>
        <url>http://github.com/94fzb/zrlog</url>
    </issueManagement>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>http://apache.org/licenses/LICENSE-2.0.txt</url>
        </license>
    </licenses>

    <dependencies>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>1.7.12</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
            <version>1.7.12</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <sourceDirectory>src/main/java</sourceDirectory>
        <testSourceDirectory>src/test/java</testSourceDirectory>
        <plugins>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                    <encoding>UTF-8</encoding>
                </configuration>
                <version>2.3.2</version>
            </plugin>
        </plugins>
    </build>
</project>
import com.zrlog.web.util.PluginHelper;
                    , new HttpJsonArrayHandle<Map>(), PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
import com.zrlog.web.util.PluginHelper;
            Map.Entry<AdminTokenVO, User> entry = null;
                entry = adminTokenService.getAdminTokenVOUserEntry(request);
                if (entry != null) {
                    AdminTokenThreadLocal.remove();
                }
            httpResponse = httpUtil.sendGetRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri + "?" + request.getQueryString(), IOUtil.getByteByInputStream(request.getInputStream()), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();