Description

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T21:17:03.173Z",
  "pubdate": "2026-09-13T21:17:03.173Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in the wxiaoqi Spring-Cloud-Platform, specifically within the OnlineController component. The flaw allows remote, unauthenticated attackers to access sensitive information by invoking the getOnlineInfo function without proper security checks.\nThis vulnerability is categorized as a Broken Access Control issue. Because the application fails to validate the authorization status of the requester before processing the request, it exposes internal administrative data to unauthorized parties.\nThe vulnerability affects versions 1.0, 2.2, and 3.0 of the Spring-Cloud-Platform. Given that a public exploit exists, the risk is considered critical, as attackers can gain unauthorized access to online user information remotely without needing prior credentials.\nImpact includes potential information disclosure of active system sessions and user activity logs. Organizations relying on this platform should prioritize implementing access controls to restrict public reachability of administrative endpoints.",
  "technicalDetails": "The vulnerability resides in the OnlineController.getOnlineInfo function located in the file aceModules/ace-admin/auth/controller/OnlineController.java. The root cause is the absence of security interceptors or authentication annotations that are required to verify the requester's identity or authorization privileges before execution.\nIn typical Spring-based applications, controller methods intended for internal administration require security frameworks like Spring Security to enforce Role-Based Access Control (RBAC). In this specific instance, the getOnlineInfo method lacks these protections, permitting the application container to execute the method when an HTTP request is directed to the mapped URL.\nThe attack flow follows a straightforward pattern: the remote attacker identifies the exposed endpoint associated with OnlineController.getOnlineInfo. By crafting a standard HTTP GET request to this endpoint, the attacker bypasses any implicit authorization logic. Upon receiving the request, the application backend executes the vulnerable function and returns the associated data, which typically contains sensitive information about currently active sessions or user connection states.\nBecause the function does not verify the security context (e.g., SecurityContextHolder in Spring Security) or check user roles, the method processes the request blindly, effectively treating any incoming packet as a trusted administrative command. This vulnerability is highly exploitable remotely as it does not require a complex chain or specific user interaction; the lack of authorization check is inherent to the function definition.\nThe post-exploitation impact includes unauthorized Information Disclosure. An attacker can map active user sessions, monitor system activity, or potentially gather intelligence for further lateral movement or session hijacking attacks. The exploit is currently public, significantly lowering the barrier to entry for malicious actors seeking to target deployments of the wxiaoqi Spring-Cloud-Platform."
}