4.3 KiB
2023-06 Cure53 Code audit
In May/June of 2023, we've had a Pentest conducted by Cure53. The following security updates, 2023.4.2 and 2023.5.3 were released as a response to the found issues.
From the complete report, these are the points we're addressing with this update:
ATH-01-001: Path traversal on blueprints allows arbitrary file-read (Medium)
This had accidentally been patched by a previous commit already; and was also only possible for users with superuser permissions.
ATH-01-003: CSS injection via faulty string replacement in Mermaid (Low)
This is an unrelated issue that was found with a third-party dependency (Mermaid), fixed with https://github.com/mermaid-js/mermaid/releases/tag/v10.2.2
Additionally we've also taken steps to further mitigate possible issues that could be caused in this way.
ATH-01-008: User-passwords disclosed to third-party service (High)
In certain circumstances, using the Enter key to submit some forms instead of clicking submit would cause the frontend to change the URL instead of calling the API, which could lead to sensitive data being disclosed.
ATH-01-009: Lack of CSRF protection in impersonate feature (Low)
Previous the URL to start an impersonation was a simple GET URL request, which was susceptible to CSRF. This has been changed to an API Post request.
ATH-01-010: Web authentication bypass via key confusion (High)
When using WebAuthn to authenticate, the owner of the WebAuthn device wasn't checked. However to exploit this, an attacker would need to be able to already intercept HTTP traffic and read the data.
ATH-01-014: Authentication challenges abused by foreign flow (Medium)
Previously it was possible to use an MFA authenticator class that wasn't allowed in a flow, if another flow existed that allowed this class. The patch changes data to be isolated per flow to prevent this issue.
ATH-01-004: Information disclosure on system endpoint (Info)
The /api/v3/admin/system/ (only accessible to superusers) endpoint returns a large amount of system info (mostly used for debugging), like the HTTP headers sent to the server. It also included all environment variables set for authentik. The environment variables have been removed.
ATH-01-005: Timing-unsafe comparison in API authentication (Info)
In the API authentication that is used by the embedded outpost (API authentication via Secret key), a timing-unsafe comparison was used.
ATH-01-012: Unintended diagram created due to unescaped quotes (Info)
Related to ATH-01-003, it was possible to insert unintended diagrams into generated diagrams.
Additional info
In addition to the points above, several of the findings are classified as intended features (such as the expression policies), however these are points where we do also see room for improvement that we will address in the future.
ATH-01-002: Stored XSS in help text of prompt module (Medium)
Prompt help texts can use HTML to add markup, which also includes the option to include JavaScript. This is only possible to configure for superusers, and in the future we're planning to add an additional toggle to limit this.
ATH-01-006: Arbitrary code execution via expressions (Critical)
This is the intended function of expression policies/property mappings, which also requires superuser permissions to edit. We're planning to also add a toggle to limit the functions that can be executed to the ones provided by authentik, and prevent the importing of modules.
ATH-01-007: SSRF via blueprints feature for fetching manifests (Medium)
Blueprints can be fetched via OCI registries, which could be potentially used for server-side request forgery. This can only be accessed by superusers, and we're planning to add an option to limit the resolved IP ranges this functionality can connect to.
ATH-01-013: XSS via CAPTCHA JavaScript URL (Medium)
Similar to ATH-01-002, any arbitrary JavaScript can be loaded using the Captcha stage. This is also limited to superusers.
ATH-01-011: Weak default configs in logout/change password flows (Info)
The default logout flow does not do any additional validation and logs the user out with a single GET request. The default password-change flow does not verify the users current password, nor does it show the current users info.