Code reading summary of the asp.net startkit timetracker (role permissions of the Catch bug notes)

In the ASP.net startkit timetracker, we can use this bug to gain the ability to access the ASPX page in an ultra vires, due to minor programming errors.

We all know that the system defines three roles, respectively

Administrator (Admin)

Project Manager (Program Manager)

Consultant (Consultant)

Admin Information page (projectlist.aspx) is accessible only to users of the Administrator role

Now let me describe the error:

Now I have an admin account for ai_ai@126.com.

We first log in with this account to create an account of the consultant role: ai_c@126.com

Then close the browser immediately. (Note that I'm talking about shutting down with mouse clicking on the browser Close button instead of the Logout button provided by the program)

Then open the browser to enter the landing page, with the account: Ai_c@126.com landing system.

Then we can access the Admin Information page using the Advisor role's account

http://localhost/TTWebCSVS_cn/ProjectList.aspx?index=2

This bug is not connected with the system role access.

Now let's find the worm.

We can see that the login user role information for the system is stored in a cookie.

The data is encrypted before it is stored, and the static method of class Formsauthentication.encrypt is used.

The name of the cookie is defined as a constant in global:

Public Const string userroles = "Userroles"

That's one of the bugs.

Now let's look at another piece of code in the Application_AuthenticateRequest event in global:

Response.cookies[userroles]. Value = cookiestr;

Response.cookies[userroles]. Path = "/";

Response.cookies[userroles]. Expires = DateTime.Now.AddMinutes (1);

As we can see from the above, the valid time for this cookie is one minute.

This way, after the previous login account is closed, the other account is logged in within a minute, so that the subsequent account can take the role information of the previous account.

Because 2 login accounts are using the same cookie called Userroles.

That's one of the bugs.