b0fbd576fc
* ATH-01-001: resolve path and check start before loading blueprints
This is even less of an issue since 411ef239f6, since with that commit we only allow files that the listing returns
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-010: fix missing user filter for webauthn device
This prevents an attack that is only possible when an attacker can intercept HTTP traffic and in the case of HTTPS decrypt it.
* ATH-01-008: fix web forms not submitting correctly when pressing enter
When submitting some forms with the Enter key instead of clicking "Confirm"/etc, the form would not get submitted correctly
This would in the worst case is when setting a user's password, where the new password can end up in the URL, but the password was not actually saved to the user.
* ATH-01-004: remove env from admin system endpoint
this endpoint already required admin access, but for debugging the env variables are used very little
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-003 / ATH-01-012: disable htmlLabels in mermaid
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-005: use hmac.compare_digest for secret_key authentication
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-009: migrate impersonation to use API
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-010: rework
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-014: save authenticator validation state in flow context
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
bugfixes
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* ATH-01-012: escape quotation marks
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* add website
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* update release ntoes
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* update with all notes
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* fix format
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
4.3 KiB
2023-06 Cure53 Code audit
In May/June of 2023, we've had a Pen-test conducted by Cure53. The following security updates, 2023.4.2 and 2023.5.3 were released as a response to the found issues.
From the complete report, these are the points we're addressing with this update:
ATH-01-001: Path traversal on blueprints allows arbitrary file-read (Medium)
This had accidentally been patched by a previous commit already; and was also only possible for users with superuser permissions.
ATH-01-003: CSS injection via faulty string replacement in Mermaid (Low)
This is an unrelated issue that was found with a third-party dependency (Mermaid), fixed with https://github.com/mermaid-js/mermaid/releases/tag/v10.2.2
Additionally we've also taken steps to further mitigate possible issues that could be caused in this way.
ATH-01-008: User-passwords disclosed to third-party service (High)
In certain circumstances, using the Enter key to submit some forms instead of clicking submit would cause the frontend to change the URL instead of calling the API, which could lead to sensitive data being disclosed.
ATH-01-009: Lack of CSRF protection in impersonate feature (Low)
Previous the URL to start an impersonation was a simple GET URL request, which was susceptible to CSRF. This has been changed to an API Post request.
ATH-01-010: Web authentication bypass via key confusion (High)
When using WebAuthn to authenticate, the owner of the WebAuthn device wasn't checked. However to exploit this, an attacker would need to be able to already intercept HTTP traffic and read the data.
ATH-01-014: Authentication challenges abused by foreign flow (Medium)
Previously it was possible to use an MFA authenticator class that wasn't allowed in a flow, if another flow existed that allowed this class. The patch changes data to be isolated per flow to prevent this issue.
ATH-01-004: Information disclosure on system endpoint (Info)
The /api/v3/admin/system/ (only accessible to superusers) endpoint returns a large amount of system info (mostly used for debugging), like the HTTP headers sent to the server. It also included all environment variables set for authentik. The environment variables have been removed.
ATH-01-005: Timing-unsafe comparison in API authentication (Info)
In the API authentication that is used by the embedded outpost (API authentication via Secret key), a timing-unsafe comparison was used.
ATH-01-012: Unintended diagram created due to unescaped quotes (Info)
Related to ATH-01-003, it was possible to insert unintended diagrams into generated diagrams.
Additional info
In addition to the points above, several of the findings are classified as intended features (such as the expression policies), however these are points where we do also see room for improvement that we will address in the future.
ATH-01-002: Stored XSS in help text of prompt module (Medium)
Prompt help texts can use HTML to add markup, which also includes the option to include JavaScript. This is only possible to configure for superusers, and in the future we're planning to add an additional toggle to limit this.
ATH-01-006: Arbitrary code execution via expressions (Critical)
This is the intended function of expression policies/property mappings, which also requires superuser permissions to edit. We're planning to also add a toggle to limit the functions that can be executed to the ones provided by authentik, and prevent the importing of modules.
ATH-01-007: SSRF via blueprints feature for fetching manifests (Medium)
Blueprints can be fetched via OCI registries, which could be potentially used for server-side request forgery. This can only be accessed by superusers, and we're planning to add an option to limit the resolved IP ranges this functionality can connect to.
ATH-01-013: XSS via CAPTCHA JavaScript URL (Medium)
Similar to ATH-01-002, any arbitrary JavaScript can be loaded using the Captcha stage. This is also limited to superusers.
ATH-01-011: Weak default configs in logout/change password flows (Info)
The default logout flow does not do any additional validation and logs the user out with a single GET request. The default password-change flow does not verify the users current password, nor does it show the current users info.