CVE-2020-19005 (published 2020-08-25T22:15Z)

zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file directly.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 5.7, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/94fzb/zrlog
commit_details: repo_url: https://github.com/94fzb/zrlog
author: xiaochun
author_date: 2019-04-14 09:34:15+08:00
msg: Fix #48 forget remove token from ThreadLocal
repository: repo_url: https://github.com/94fzb/zrlog
repo_name: 94fzb/zrlog
description: ZrLog是使用 Java 开发的博客/CMS程序，具有简约，易用，组件化，内存占用低等特点。自带 Markdown 编辑器，让更多的精力放在写作上，而不是花费大量时间在学习程序的使用上。
repo_language: Java
owner: 94fzb
file_changes: filename: PluginHelper.java
change_type: ModificationType.RENAME
diff: @@ -1,8 +1,7 @@
-package com.zrlog.service;
+package com.zrlog.web.util;
 
-import com.jfinal.core.JFinal;
 import com.zrlog.common.vo.AdminTokenVO;
-import com.zrlog.model.User;
+import com.zrlog.util.BlogBuildInfoUtil;
 import com.zrlog.util.I18nUtil;
 import com.zrlog.util.ZrLogUtil;
 
@@ -12,17 +11,14 @@ import java.util.Map;
 
 public class PluginHelper {
 
-    public static Map<String, String> genHeaderMapByRequest(HttpServletRequest request) {
+    public static Map<String, String> genHeaderMapByRequest(HttpServletRequest request, AdminTokenVO adminTokenVO) {
         Map<String, String> map = new HashMap<>();
-        AdminTokenVO adminTokenVO = AdminTokenThreadLocal.getUser();
         if (adminTokenVO != null) {
-            User user = User.dao.findById(adminTokenVO.getUserId());
-            map.put("LoginUserName", user.get("userName").toString());
             map.put("LoginUserId", adminTokenVO.getUserId() + "");
         }
         map.put("IsLogin", (adminTokenVO != null) + "");
         map.put("Current-Locale", I18nUtil.getCurrentLocale());
-        map.put("Blog-Version", ((Map) JFinal.me().getServletContext().getAttribute("zrlog")).get("version").toString());
+        map.put("Blog-Version", BlogBuildInfoUtil.getVersion());
         if (request != null) {
             String fullUrl = ZrLogUtil.getFullUrl(request);
             if (request.getQueryString() != null) {

programming_language: Java
filename: pom.xml
change_type: ModificationType.ADD
diff: @@ -0,0 +1,104 @@
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.zrlog</groupId>
+    <artifactId>zrlog</artifactId>
+    <version>2.1.0</version>
+    <modules>
+        <module>web</module>
+        <module>service</module>
+        <module>common</module>
+        <module>data</module>
+    </modules>
+    <packaging>pom</packaging>
+    <name>zrlog</name>
+    <description>ZrLog是使用Java开发的博客/CMS程序，具有简约，易用，组件化，内存占用低等特点。自带Markdown编辑器，让更多的精力放在写作上，而不是花费大量时间在学习程序的使用上。
+    </description>
+    <url>https://www.zrlog.com</url>
+
+    <properties>
+        <java.version>1.8</java.version>
+        <jfinal.version>3.3</jfinal.version>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <servlet.version>3.1.0</servlet.version>
+    </properties>
+
+    <developers>
+        <developer>
+            <name>xiaochun</name>
+            <email>xchun90@163.com</email>
+            <url>http://blog.94fzb.com</url>
+            <roles>
+                <role>owner</role>
+            </roles>
+        </developer>
+        <developer>
+            <name>weekdragon</name>
+            <email>790774717@qq.com</email>
+            <url>https://www.weekdragon.cn</url>
+            <roles>
+                <role>developer</role>
+            </roles>
+        </developer>
+        <developer>
+            <name>e-lionel</name>
+            <email>lionel0724@163.com</email>
+            <url>https://github.com/e-lionel</url>
+            <roles>
+                <role>reporter</role>
+            </roles>
+        </developer>
+    </developers>
+
+    <issueManagement>
+        <system>Github Issue</system>
+        <url>http://github.com/94fzb/zrlog</url>
+    </issueManagement>
+
+    <licenses>
+        <license>
+            <name>The Apache Software License, Version 2.0</name>
+            <url>http://apache.org/licenses/LICENSE-2.0.txt</url>
+        </license>
+    </licenses>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>1.7.12</version>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+            <version>1.7.12</version>
+        </dependency>
+        <dependency>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+            <version>1.2.17</version>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.12</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <sourceDirectory>src/main/java</sourceDirectory>
+        <testSourceDirectory>src/test/java</testSourceDirectory>
+        <plugins>
+            <plugin>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${java.version}</source>
+                    <target>${java.version}</target>
+                    <encoding>UTF-8</encoding>
+                </configuration>
+                <version>2.3.2</version>
+            </plugin>
+        </plugins>
+    </build>
+</project>
\ No newline at end of file

programming_language: HTML
filename: UploadService.java
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@ import com.hibegin.common.util.http.HttpUtil;
 import com.hibegin.common.util.http.handle.HttpJsonArrayHandle;
 import com.zrlog.common.Constants;
 import com.zrlog.common.response.UploadFileResponse;
+import com.zrlog.web.util.PluginHelper;
 import org.apache.log4j.Logger;
 
 import javax.servlet.http.HttpServletRequest;
@@ -24,7 +25,7 @@ public class UploadService {
         String url;
         try {
             List<Map> urls = HttpUtil.getInstance().sendGetRequest(Constants.pluginServer + "/service", map
-                    , new HttpJsonArrayHandle<Map>(), PluginHelper.genHeaderMapByRequest(request)).getT();
+                    , new HttpJsonArrayHandle<Map>(), PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
             if (urls != null && !urls.isEmpty()) {
                 url = (String) urls.get(0).get("url");
                 if (!url.startsWith("https://") && !url.startsWith("http://")) {

programming_language: Java
filename: PluginHandler.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import com.zrlog.common.vo.AdminTokenVO;
 import com.zrlog.model.User;
 import com.zrlog.service.AdminTokenService;
 import com.zrlog.service.AdminTokenThreadLocal;
-import com.zrlog.service.PluginHelper;
 import com.zrlog.util.BlogBuildInfoUtil;
+import com.zrlog.web.util.PluginHelper;
 import org.apache.http.Header;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.log4j.Logger;
@@ -52,8 +52,9 @@ public class PluginHandler extends Handler {
             }
         }
         if (isPluginPath) {
+            Map.Entry<AdminTokenVO, User> entry = null;
             try {
-                Map.Entry<AdminTokenVO, User> entry = adminTokenService.getAdminTokenVOUserEntry(request);
+                entry = adminTokenService.getAdminTokenVOUserEntry(request);
                 if (entry != null) {
                     adminTokenService.setAdminToken(entry.getValue(), entry.getKey().getSessionId(), entry.getKey().getProtocol(), request, response);
                 }
@@ -72,6 +73,9 @@ public class PluginHandler extends Handler {
                 }
             } finally {
                 isHandled[0] = true;
+                if (entry != null) {
+                    AdminTokenThreadLocal.remove();
+                }
             }
         } else {
             this.next.handle(target, request, response, isHandled);
@@ -153,13 +157,13 @@ public class PluginHandler extends Handler {
         HttpUtil httpUtil = disableRedirect ? HttpUtil.getDisableRedirectInstance() : HttpUtil.getInstance();
         //GET请求不关心request.getInputStream() 的数据
         if (method.equals(request.getMethod()) && "GET".equalsIgnoreCase(method)) {
-            httpResponse = httpUtil.sendGetRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request)).getT();
+            httpResponse = httpUtil.sendGetRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
         } else {
             //如果是表单数据提交不关心请求头，反之将所有请求头都发到插件服务
             if ("application/x-www-form-urlencoded".equals(request.getContentType())) {
-                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request)).getT();
+                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri, request.getParameterMap(), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
             } else {
-                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri + "?" + request.getQueryString(), IOUtil.getByteByInputStream(request.getInputStream()), handle, PluginHelper.genHeaderMapByRequest(request)).getT();
+                httpResponse = httpUtil.sendPostRequest(pluginServerHttp + uri + "?" + request.getQueryString(), IOUtil.getByteByInputStream(request.getInputStream()), handle, PluginHelper.genHeaderMapByRequest(request, AdminTokenThreadLocal.getUser())).getT();
             }
         }
         //添加插件服务的HTTP响应头到调用者响应头里面

programming_language: Java