QingScan authentication bypass via hard-coded administrator identity

[fa1c4]

1. Bug Topic

Unauthenticated administrative access due to hard-coded administrator identity in Common::initialize().

2. Release Version / Commit Hash / Affected Range

c51c45f

3. Bug Type

Authentication bypass / authorization bypass.

4. CWE

CWE-306: Missing Authentication for Critical Function; CWE-862: Missing Authorization.

5. Bug Summary

Common::initialize() comments out the original login check and directly assigns the current request to user admin. As a result, controllers extending Common execute as administrator even when no valid session or cookie exists.

6. Root Cause

The intended scan_user login validation is commented out and replaced with a hard-coded administrator identity. The later permission check trusts that identity and grants access because admin appears in env('admins').

7. Attack Preconditions

The attacker only needs network access to the QingScan web application. No account, cookie, or CSRF token is required.

8. Impact Analysis

An unauthenticated attacker can invoke privileged actions, including deleting code audit projects, clearing scan results, restarting scans, reading scan findings, and uploading target ZIP files.

9. Affected Code

• code/app/controller/Common.php::initialize() hard-coded admin identity and commented login validation.
• code/app/controller/Common.php::is_auth() trusts env('admins') after the username has already been set to admin.
• code/app/code/controller/Index.php::code_del(), batch_del(), qingkong(), again_scan(), add_file(), and related actions.

10. PoC

https://github.com/fa1c4/security-advisories/tree/main/qingscan

Successful output contains:

[VULNERABLE] unauthenticated request executed admin-only code_del and deleted a code audit project.