CVE-2021-21403 (published 2021-03-26T18:15Z)

In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/kongchuanhujiao/server
commit_details: repo_url: https://github.com/kongchuanhujiao/server
author: 千橘 雫霞
author_date: 2021-03-16 19:18:48+08:00
msg: 重构：优化验证码生成逻辑，最小化权责
repository: repo_url: https://github.com/kongchuanhujiao/server
repo_name: kongchuanhujiao/ProvinceServer
description: 《互联网+ 空中与传统互动教学AI系统》服务 | 帮助教师追踪学生上课状态、知识巩固等场景，优化和提升教学体验。
repo_language: Go
owner: kongchuanhujiao
file_changes: filename: memory.go
change_type: ModificationType.MODIFY
diff: @@ -1,15 +1,39 @@
 package account
 
-import "github.com/kongchuanhujiao/server/internal/app/datahub/internal/memory"
+import (
+	"math/rand"
+	"strconv"
+	"time"
 
-func GetCode(id string) string {
-	return memory.Code[id]
-}
+	"github.com/kongchuanhujiao/server/internal/app/datahub/internal/memory"
+)
+
+// GenerateCode 写入验证码返回一个验证码
+func GenerateCode(id string) (c string) {
+
+	rand.Seed(time.Now().UnixNano())
+	c = strconv.FormatFloat(rand.Float64(), 'f', -1, 64)[2:6]
 
-func WriteCode(id string, code string) {
-	memory.Code[id] = code
+	memory.Code[id] = c
+
+	go func() {
+		timer := time.NewTimer(5 * time.Minute)
+		defer timer.Stop()
+		<-timer.C
+		deleteCode(id)
+	}()
+
+	return
 }
 
-func DeleteCode(id string) {
-	delete(memory.Code, id)
+// VerifyCode 验证验证码
+func VerifyCode(id string, code string) (ok bool) {
+	if code == memory.Code[id] {
+		ok = true
+		deleteCode(id)
+	}
+	return
 }
+
+// deleteCode 删除验证码
+func deleteCode(id string) { delete(memory.Code, id) }

programming_language: Go
filename: apis.go
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@ type PostLoginReq struct {
 // 调用方法：POST apis/accounts/login
 func (a *APIs) PostLogin(v *PostLoginReq) *kongchuanhujiao.Response {
 
-	if v.Code != account.GetCode(v.ID) || v.Code == "" { // FIXME datahub 鉴权
+	if account.VerifyCode(v.ID, v.Code) || v.Code == "" {
 		return kongchuanhujiao.GenerateErrResp(1, "验证码有误")
 	}
 

programming_language: Go
filename: utils.go
change_type: ModificationType.MODIFY
diff: @@ -2,10 +2,6 @@ package account
 
 import (
 	"errors"
-	"math/rand"
-	"strconv"
-	"time"
-
 	"github.com/kongchuanhujiao/server/internal/app/client"
 	"github.com/kongchuanhujiao/server/internal/app/client/message"
 	"github.com/kongchuanhujiao/server/internal/app/datahub/pkg/account"
@@ -22,27 +18,14 @@ func sendCode(id string) (err error) {
 		logger.Error("发送验证码失败", zap.Error(err))
 		return
 	}
-
 	if len(a) == 0 {
 		return errors.New("账号不存在")
 	}
 
-	rand.Seed(time.Now().UnixNano())
-	c := strconv.FormatFloat(rand.Float64(), 'f', -1, 64)[2:6]
-
 	client.GetClient().SendMessage(
-		message.NewTextMessage("您的验证码是：" + c + "，请勿泄露给他人。有效期5分钟").
+		message.NewTextMessage("您的验证码是：" + account.GenerateCode(id) + "，请勿泄露给他人。有效期5分钟").
 			SetTarget(&message.Target{ID: a[0].QQ}),
 	)
 
-	account.WriteCode(id, c)
-
-	go func() {
-		timer := time.NewTimer(5 * time.Minute)
-		defer timer.Stop()
-		<-timer.C
-		account.DeleteCode(id)
-	}()
-
 	return
 }

programming_language: Go