IDOR in hub API endpoints that read system ID from URL parameter 漏洞概述 Beszel 的某些 API 端点接受用户提供的系统 ID，且未进行进一步检查以验证用户是否有权访问该系统。这导致任何经过身份验证的用户，只要知道系统 ID，就可以访问这些路由。系统 ID 是随机的 15 个字符的字母数字字符串。 影响范围 受影响版本: = 0.18.7 受影响文件: (lines 283-361) 受影响端点: 漏洞代码 (Vulnerable Code) POC 代码 (Proof of Concept) Step 4: Authenticate as User A Step 5: Get hub public key Step 6: Create a universal token and start the agent Step 7: Verify User A sees the system Step 8: Authenticate as User B (readonly) Step 9: Control test — standard API blocks User B Step 10: IDOR — SMART refresh (User B triggers action on User A's system) Step 11: IDOR — System info (User B reads from User A's system) Step 12: IDOR — Container logs (User B reads from User A's system) Step 13: IDOR — Container info (User B reads from User A's system)