Skip to main content

2023-06 Cure53 Code audit

In May/June of 2023, we had a pentest conducted by Cure53. The following security updates, 2023.4.2 and 2023.5.3 were released as a response to the found issues.

From the complete report, these are the points we're addressing with this update:

ATH-01-001: Path traversal on blueprints allows arbitrary file-read (Medium)​

This had accidentally been patched by a previous commit already; and was also only possible for users with superuser permissions.

ATH-01-003: CSS injection via faulty string replacement in Mermaid (Low)​

This is an unrelated issue that was found with a third-party dependency (Mermaid), fixed with https://github.com/mermaid-js/mermaid/releases/tag/v10.2.2

Additionally we've also taken steps to further mitigate possible issues that could be caused in this way.

ATH-01-008: User-passwords disclosed to third-party service (High)​

In certain circumstances, using the Enter key to submit some forms instead of clicking submit would cause the frontend to change the URL instead of calling the API, which could lead to sensitive data being disclosed.

ATH-01-009: Lack of CSRF protection in impersonate feature (Low)​

Previous the URL to start an impersonation was a simple GET URL request, which was susceptible to CSRF. This has been changed to an API Post request.

ATH-01-010: Web authentication bypass via key confusion (High)​

When using WebAuthn to authenticate, the owner of the WebAuthn device wasn't checked. However to exploit this, an attacker would need to be able to already intercept HTTP traffic and read the data.

ATH-01-014: Authentication challenges abused by foreign flow (Medium)​

Previously it was possible to use an MFA authenticator class that wasn't allowed in a flow, if another flow existed that allowed this class. The patch changes data to be isolated per flow to prevent this issue.

ATH-01-004: Information disclosure on system endpoint (Info)​

The /api/v3/admin/system/ (only accessible to superusers) endpoint returns a large amount of system info (mostly used for debugging), like the HTTP headers sent to the server. It also included all environment variables set for authentik. The environment variables have been removed.

ATH-01-005: Timing-unsafe comparison in API authentication (Info)​

In the API authentication that is used by the embedded outpost (API authentication via Secret key), a timing-unsafe comparison was used.

ATH-01-012: Unintended diagram created due to unescaped quotes (Info)​

Related to ATH-01-003, it was possible to insert unintended diagrams into generated diagrams.

Additional info​

In addition to the points above, several of the findings are classified as intended features (such as the expression policies). However, we have published additional hardening documentation to provide guidance for further measures that can be taken to limit any possible risks associated with these features.

ATH-01-002: Stored XSS in help text of prompt module (Medium)​

Prompt help texts can use HTML to add markup, which also includes the option to include JavaScript. This is only possible to configure for superusers. To mitigate the risk of a rogue superuser creating a stage with a malicious script, requests to the /api/v3/stages/captcha* and /api/v3/managed/blueprints* endpoints can be blocked. With these restrictions in place, Captcha stages can only be edited using Blueprints on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

ATH-01-006: Arbitrary code execution via expressions (Critical)​

This is the intended function of expression policies/property mappings, which also requires superuser permissions to edit. To mitigate the risk of a rogue superuser creating a malicious expression, requests to the /api/v3/policies/expression*, /api/v3/propertymappings*, and /api/v3/managed/blueprints* endpoints can be blocked. With these restrictions in place, expression can only be edited using Blueprints on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

ATH-01-007: SSRF via blueprints feature for fetching manifests (Medium)​

Superusers can fetch blueprints via OCI registries, which could be potentially used for server-side request forgery. To mitigate the risk of a rogue superuser sending malicious requests, requests to the /api/v3/managed/blueprints* endpoint can be blocked. With these restrictions in place, blueprints can only be edited using YAML files on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

ATH-01-013: XSS via CAPTCHA JavaScript URL (Medium)​

Similar to ATH-01-002, any arbitrary JavaScript can be loaded using the Captcha stage. This is also limited to superusers. In order to prevent potential exploitation, it is recommended to limit the setting to allow-listed JavaScript URLs only.

ATH-01-011: Weak default configs in logout/change password flows (Info)​

The default logout flow does not do any additional validation and logs the user out with a single GET request. The default password-change flow does not verify the users current password, nor does it show the current users info.