[checkmk-commits] [Checkmk/checkmk] 6a2252: 17095 SEC Sanitize Host and Folder Credentials in ...

Branch: refs/heads/2.1.0 Home: https://github.com/Checkmk/checkmk Commit: 6a22528171e177c08cd923e943601e5a301de399 https://github.com/Checkmk/checkmk/commit/6a22528171e177c08cd923e943601e5a3… Author: Hannes Rantzsch <hannes.rantzsch(a)checkmk.com> Date: 2024-10-07 (Mon, 07 Oct 2024) Changed paths: A .werks/17095 M cmk/gui/watolib/host_attributes.py M cmk/gui/watolib/hosts_and_folders.py M cmk/utils/object_diff.py Log Message: ----------- 17095 SEC Sanitize Host and Folder Credentials in Audit Log CVE-2024-38862 CMK-17985 Change-Id: I4f5fab7932b45dd3f152426f8dc15252437f0f37 Commit: cc52589a24be4ecade6326dce1eef880121ff4bb https://github.com/Checkmk/checkmk/commit/cc52589a24be4ecade6326dce1eef8801… Author: Hannes Rantzsch <hannes.rantzsch(a)checkmk.com> Date: 2024-10-07 (Mon, 07 Oct 2024) Changed paths: A .werks/17096 M cmk/gui/htmllib/__init__.py M cmk/gui/utils/csrf_token.py M cmk/gui/utils/urls.py M cmk/gui/watolib/hosts_and_folders.py M web/htdocs/js/modules/ajax.js M web/htdocs/js/modules/forms.js Log Message: ----------- 17096 SEC CSRF token leaked in URL parameters (CVE-2024-38863) Before this Werk, the CSRF token was mistakenly included as a query parameter in certain URLs when navigating Checkmk, which could result in the token being saved in bookmarks. This increased the risk of unintentional exposure, such as when sharing bookmarks with other users. The issue has been resolved. While storing or unintentionally exposing the token doesn't present an immediate security threat, it could potentially enable phishing attacks targeting the specific user for the duration of the token's validity. In Checkmk, CSRF tokens remain valid for the session's duration (configured under Global settings > Session management). This issue was found during internal review. *Affected Versions*: * 2.3.0 * 2.2.0 * 2.1.0 *Mitigations*: Avoid sharing or exposing URLs that contain the query parameter `csrf_token=`. *Vulnerability Management*: We have rated the issue with a CVSS Score of 2.0 Low (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L`) and assigned `CVE-2024-38863`. CMK-18866 Change-Id: I60bd4f0a674c12c198dfed88aee0bb392971cea7 Compare: https://github.com/Checkmk/checkmk/compare/b7371d706155...cc52589a24be To unsubscribe from these emails, change your notification settings at https://github.com/Checkmk/checkmk/settings/notifications