青龙面板 /open/user/init 登录绕过

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/whyour/qinglong/issues/2934
• https://zhuanlan.zhihu.com/p/2010711333633537126
• https://github.com/Mr-xn/Penetration_Testing_POC/blob/master/qinglong-auth-bypass2rce/%E9%9D%92%E9%BE%99(qinglong)%E9%9D%A2%E6%9D%BF%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E8%87%B4%E6%9C%AA%E6%8E%88%E6%9D%83%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(RCE)%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E5%A4%8D%E7%8E%B0.md
• https://snyk.io/blog/qinglong-task-scheduler-rce-vulnerabilities/
• https://www.bleepingcomputer.com/news/security/hackers-exploit-rce-flaws-in-qinglong-task-scheduler-for-cryptomining/
• https://github.com/whyour/qinglong/issues/2933

Related Vulnerabilities

• PoC青龙-定时任务管理面板 /open/user/init 权限绕过漏洞
• 青龙面板dependencies 登录绕过导致命令执行
• 青龙面板 权限绕过导致RCE