The latest version 1.3.145 of Alibaba Cloud locks can be Bypass.

The latest version 1.3.145 of Alibaba Cloud locks can be Bypass.

Three bypass protection packages

\ X00: Apart from post protection, get \ cookie can be bypassed. In addition, X-Forward-For injection statements in header are completely unprotected. Manual configuration of protection rules:
 

No configuration in header.

1. \ x00 Get bypass:

After the following python script is executed, a successful bypass is detected. No protection prompt is displayed:
 

2. According to the above principle, \ x00 can also bypass cookies

3. No protection in the header:
 

 

Solution:

Process special content