Checkmk werks security June 2015

checkmk-werks-sec@lists.checkmk.com

1 participants
9 discussions

Check_MK Werk 2392: Auth cookie is always using "httponly" flag

by Lars Michelsen

ID: 2392 Title: Auth cookie is always using "httponly" flag Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 All newly issued authentication cookies have the flag "httponly" set now. This makes the cookie values inaccessible from scripts executed in the browser, e.g. from Javascript. This secures the cookie against some sorts of cookie stealing attempts. See https://www.owasp.org/index.php/HttpOnly for details.

8 years, 10 months

Check_MK Werk 2391: Auth cookie is using "secure" flag when HTTPS request detected

by Lars Michelsen

ID: 2391 Title: Auth cookie is using "secure" flag when HTTPS request detected Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 In previous versions the authentication cookie, which identifies an authenticated user with the GUI, was never using the "secure" flag. This means the cookie was sent to the webserver when doing HTTP and HTTPS requests. In such a situation a user which authenticated using HTTPS could access the GUI using HTTP and was still authenticated becaus the browser sends the HTTPS related cookie via HTTP. This is some kind of security risk since the information which should only be transported using the encrypted HTTPS requests could be transported in clear text over the network using HTTP. The GUI tries now to detect the HTTPS requests. In case a HTTPS request is detected, the cookies are set with the "secure" flag which makes the cookies only used via HTTPS. The HTTPS detection currently checks wether or not the HTTP request header <tt>X-Forwarded-Proto</tt> is set to <tt>https</tt>.

8 years, 10 months

Check_MK Werk 2390: Fixed possible XSS issue on views

by Lars Michelsen

ID: 2390 Title: Fixed possible XSS issue on views Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 It was possible to use the view_name variable to inject HTML/Javascript code into the status GUI views.

8 years, 10 months

Check_MK Werk 2389: Fixed XSS using the _body_class parameter of views

by Lars Michelsen

ID: 2389 Title: Fixed XSS using the _body_class parameter of views Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 It was possible to use the _body_class parameter of the status GUI views to inject HTML/Javascript code into the pages. The _body_class parameter, which was only used for internal purposes, has totally been removed now.

8 years, 10 months

Check_MK Werk 2388: Fixed reflected XSS on the index page using the start_url parameter

by Lars Michelsen

ID: 2388 Title: Fixed reflected XSS on the index page using the start_url parameter Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3

8 years, 10 months

Check_MK Werk 2387: Fixed XSS problem on all pages using confirm dialogs outputting user provided parameters

by Lars Michelsen

ID: 2387 Title: Fixed XSS problem on all pages using confirm dialogs outputting user provided parameters Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 On some pages, like for example the host group management page of WATO, it was possible to inject user provided HTML/Javascript code into the confirm messages. An attacker could use this to let an authenticated user open a prepared URL for privilege escalation.

8 years, 10 months

Check_MK Werk 2386: Fixed possible XSS on WATO rule edit page

by Lars Michelsen

ID: 2386 Title: Fixed possible XSS on WATO rule edit page Component: WATO Level: 1 Class: Security Fix Version: 1.2.7i3 A possible XSS injection has been fixed on the rule edit page of WATO. It was possible to inject javascript code using the HTTP parameters the page is processing.

8 years, 10 months

Check_MK Werk 2385: Fixed possible reflected XSS on all GUI pages where users can produce unhandled exceptions

by Lars Michelsen

ID: 2385 Title: Fixed possible reflected XSS on all GUI pages where users can produce unhandled exceptions Component: Multisite Level: 1 Class: Security Fix Version: 1.2.7i3 On pages where an authenticated user can trigger an exception which is then displayed to the user as "Internal error" dialog with details about the exception, it was possible for the user to inject javascript code which was executed in the context of the authenticated user. This has been fixed that javascript/html code which is injected is being escaped correctly.

8 years, 10 months

Check_MK Werk 2384: Prevent user passwords from being visible in webserver log on user creation

by Lars Michelsen

ID: 2384 Title: Prevent user passwords from being visible in webserver log on user creation Component: WATO Level: 1 Class: Security Fix Version: 1.2.7i3 When a user is created using WATO, the set values of the form fields were logged directly into the webserver access log, because the form of this page used the GET request method. Users which have access to the log files would be able to see the initial passwords. If you use an older version of Check_MK it is a good idea to set the "Change password at next login or access" to force the user to change his password on first login. We changed this form to perform a POST request now to prevent these information being written to the logs.

8 years, 10 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

Checkmk werks security June 2015