Aias00 opened a new pull request, #6388:
URL: https://github.com/apache/shenyu/pull/6388
## Summary
Fix authorization bypass vulnerabilities in two admin dashboard endpoints
that allow low-privileged users to rotate arbitrary appAuth secrets and forge
signed requests.
## Vulnerability Details
### 1. `/appAuth/updateSk` — Missing permission annotation (High)
`AppAuthController.updateSk()` was the **only endpoint** in the controller
without a `@RequiresPermissions` annotation. Every other endpoint (`apply`,
`findPageByQuery`, `detail`, `updateDetail`, `detailPath`, `updateDetailPath`,
`batchDelete`, `batchEnabled`, `batchOpened`, `syncData`) has proper permission
checks.
This allowed any authenticated dashboard user (including lowest-privilege
`default` role) to modify the `appSecret` of any application.
Additionally, the endpoint used `@GetMapping`, causing `appSecret` to appear
in URLs, browser history, and server access logs.
### 2. `/sandbox/proxyGateway` — Missing permission annotation (Medium-High)
`SandboxController.proxyGateway()` had no `@RequiresPermissions` annotation.
It accepts caller-controlled request data, looks up the server-side `appSecret`
for a given `appKey`, generates a valid signature, and forwards the request to
an allowlisted target.
### 3. Attack Chain
When combined:
1. Low-privileged user rotates a target appKey's secret via
`/appAuth/updateSk`
2. Calls `/sandbox/proxyGateway` with the controlled `appKey` and
attacker-chosen request data
3. Server generates a valid signature using the attacker-controlled secret
and forwards the request
4. Result: impersonation of application identities, authenticated access to
sign-protected APIs
## Changes
- **AppAuthController.java**: Add
`@RequiresPermissions("system:authen:edit")` + change `@GetMapping` to
`@PostMapping`
- **SandboxController.java**: Add
`@RequiresPermissions("system:authen:list")`
- **AppAuthControllerTest.java**: Update `testUpdateSk` from GET to POST
- **http-debug-app-auth-controller-api.http**: Update updateSk request from
GET to POST
## Testing
- All 17 controller tests pass (AppAuthControllerTest: 16,
SandboxControllerTest: 1)
## Security Impact
- Prevents low-privilege users from rotating arbitrary appAuth secrets
- Prevents unauthorized use of the sandbox proxy gateway for signed request
forgery
- Breaks the attack chain described in the security report
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
