youngkermit8-coder opened a new issue, #1684: URL: https://github.com/apache/rocketmq-dashboard/issues/1684
## Security bug `AuthInterceptor.READER_POST_PATHS` treats `POST /api/clusters/test-connection` as a read-only operation. The endpoint accepts an arbitrary `namesrvAddr` and `ClusterConnectionService` opens a real RocketMQ admin connection to that server-supplied destination. As a result, any authenticated non-admin reader can make the dashboard server initiate outbound RocketMQ connections to arbitrary hosts and ports. This creates a blind internal-network probing primitive and bypasses the intended rule that only administrators may perform server-side connection tests. The analogous data-source connection-test endpoint is already admin-only. ## Reproduction 1. Enable login and authenticate as a configured non-admin user. 2. Send `POST /api/clusters/test-connection` with a chosen internal or otherwise arbitrary `namesrvAddr`. 3. Observe that `AuthInterceptor.preHandle` allows the request and the server attempts the connection. ## Expected behavior Only administrators should be allowed to invoke the NameServer connection-test endpoint. Ordinary readers should receive HTTP 403 before any connection attempt. ## Proposed scope - Remove `/api/clusters/test-connection` from the non-admin POST allowlist. - Add an authorization regression test proving a reader receives 403. - Add the matching admin regression to preserve the intended setup workflow. ## Duplicate check Searched open and closed issues and pull requests for NameServer connection-test authorization, read-only role access, arbitrary `namesrvAddr`, and blind SSRF/network probing. No matching contribution was found. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
