[checkmk-commits] [Checkmk/checkmk] 3a8440: 17096 SEC CSRF token leaked in URL parameters (CVE...

Branch: refs/heads/2.3.0 Home: https://github.com/Checkmk/checkmk Commit: 3a84407b5b10778bf12328e6ff547ea4e506bccd https://github.com/Checkmk/checkmk/commit/3a84407b5b10778bf12328e6ff547ea4e… Author: Hannes Rantzsch <hannes.rantzsch(a)checkmk.com> Date: 2024-10-07 (Mon, 07 Oct 2024) Changed paths: A .werks/17096.md M cmk/gui/htmllib/html.py M cmk/gui/utils/csrf_token.py M cmk/gui/utils/urls.py M cmk/gui/watolib/hosts_and_folders.py M web/htdocs/js/modules/ajax.ts M web/htdocs/js/modules/forms.ts Log Message: ----------- 17096 SEC CSRF token leaked in URL parameters (CVE-2024-38863) Before this Werk, the CSRF token was mistakenly included as a query parameter in certain URLs when navigating Checkmk, which could result in the token being saved in bookmarks. This increased the risk of unintentional exposure, such as when sharing bookmarks with other users. The issue has been resolved. While storing or unintentionally exposing the token doesn't present an immediate security threat, it could potentially enable phishing attacks targeting the specific user for the duration of the token's validity. In Checkmk, CSRF tokens remain valid for the session's duration (configured under Global settings > Session management). This issue was found during internal review. *Affected Versions*: * 2.3.0 * 2.2.0 * 2.1.0 *Mitigations*: Avoid sharing or exposing URLs that contain the query parameter `csrf_token=`. *Vulnerability Management*: We have rated the issue with a CVSS Score of 2.0 Low (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L`) and assigned `CVE-2024-38863`. CMK-18866 Change-Id: I60bd4f0a674c12c198dfed88aee0bb392971cea7 Commit: 51a7fdc7d3de73efe60502fe0e7de61b6190ccb4 https://github.com/Checkmk/checkmk/commit/51a7fdc7d3de73efe60502fe0e7de61b6… Author: Hannes Rantzsch <hannes.rantzsch(a)checkmk.com> Date: 2024-10-07 (Mon, 07 Oct 2024) Changed paths: A .werks/17095.md M cmk/gui/watolib/host_attributes.py M cmk/gui/watolib/hosts_and_folders.py M tests/unit/cmk/gui/watolib/test_hosts_and_folders.py Log Message: ----------- 17095 SEC Sanitize Host and Folder Credentials in Audit Log CVE-2024-38862 CMK-17985 Change-Id: I4f5fab7932b45dd3f152426f8dc15252437f0f37 Compare: https://github.com/Checkmk/checkmk/compare/3876dec2d7a4...51a7fdc7d3de To unsubscribe from these emails, change your notification settings at https://github.com/Checkmk/checkmk/settings/notifications