(1) Vulnerability description
This loophole is a logical loophole, which refers to a logical loophole in the business implementation of the developer during the development process. The reason for the logical loopholes is that some developers, in the development process, the first consideration is how to realize the function, especially for some new developers, it is a difficult problem for them to realize a certain business. without considering safety.
This login bypass vulnerability occurs during the authentication process. The reason for this login bypass vulnerability is that the development uses the status code as a parameter for login identification. After the user enters the account number and password, click submit, the data is sent to the back-end server, the server queries the database, uses different status codes to indicate different responses, and then sends these status codes to the front-end, after the front-end accepts, according to the status code, Give whether to log in.
If the attacker intercepts the data packet during the process, and then modifies the status code of the data packet to the correct login status code, in this case, no matter what account and password the user enters, just intercept the response data packet and modify the status code of the data packet In order to give the login status code, authentication is useless.
(2) Vulnerability process description:
- Enter the website https://xxx.com in the url, first use the password account admin, password: 123456, log in, and find that the user does not exist, here you can test the blasting account
2. Press F12 to enter the debugger, check the js code, and find that the web page has passed the status code, and judge whether it is passed.
Among them, 200 is successfully passed, 201 is the user does not exist, 202 is the password is incorrect,
3. Next, try to log in to bypass, or admin-123456, click to log in, then use bp to intercept the data packet, then right click, select intercept, select the response to the interception request, and click release
4. Modify the data packet, the code field should be the status code, change it to 200, the is_admin field should be to judge whether it is an administrator authority, or simply change it to 1, and the nick_name field should be the user name, because the previous login with admin shows that the user is not It exists, and the nick_name field has no value. The high probability is the user name. To be on the safe side, assign nick_name to admin, as shown in the figure. After the modification is complete, click Release
4. Click to release, then close the bp interception, return to the browser, and find that it has successfully entered the background. It turns out that there is nothing in this URL, and it should be abandoned.
