Version: <= 0.0.1-SNAPSHOT

Branch: master branch

Description:

There is a privilege escalation vulnerability in Vblog, allowing an attacker to exploit it and perform arbitrary user registration with normal user permissions.

Sourcecode Analysis

In the org.sang.config.WebSecurityConfig#configure method, the /reg endpoint is configured to be accessible only by super administrators.
However, the Spring Security authentication framework used by the application can be bypassed by appending a trailing / to the endpoint, allowing regular users to access the /reg interface.

Reproduce the vulnerablitity

Directly accessing the /reg endpoint returns a message indicating that it is accessible only to super administrators.

However, accessing /reg/ results in a privilege escalation. This allows regular users to arbitrarily register new users.