Description
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| izhaorui | Zr.Admin.NET | — | — |
References
- https://vul.yulun.ac.cn/20261114/zr-admin-net/ third-party-advisory
- https://github.com/izhaorui/Zr.Admin.NET/issues/27 issue-tracking
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L145-L157 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L84-L120 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksLogController.cs#L31-L46 technical-description
- VulnCheck Advisory: Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get third-party-advisory