Beta 5.2

[SubleXBle]

Summary

This PR addresses multiple critical security vulnerabilities discovered in the multi-server synchronization and authentication subsystems introduced in v0.5.0. It cumulative-patches all issues reported by the security community, transitioning the project into a hardened, production-ready state for v0.5.2.

Changes Included

1. Centralized Authentication Gate (auth.php & header.php)

   • Fixed a critical authentication bypass where unauthenticated sessions were incorrectly granted a default viewer role.
   • Enforced strict session-level barrier ($_SESSION['username']) on all data and read plane endpoints (get-blocklist.php, get-json.php, etc.).

2. Secure Password Hashing (manage_users.sh & manage-clients.sh)

   • Mitigated a shell command injection vulnerability where passwords containing specific characters (like apostrophes) were executed as raw PHP program text.
   • Switched to passing credentials safely via isolated environment variables (getenv()) combined with strict alphanumeric username validation.

3. Process Table Hardening (syncback.sh & fail2ban_log2json.sh)

   • Fixed a credentials leak where sync keys (CLIENT_PASS) were exposed to the host's public process listing (argv) via curl -F.
   • Refactored requests to dynamically pass credentials using temporary, restricted configuration files (chmod 600).

4. API Endpoint Security (action_report-ip.php)

   • Enforced mandatory admin privilege validation on the reporting plane.
   • Integrated IP structure enforcement (FILTER_VALIDATE_IP) and hardcoded whitelisting for external service modules (AbuseIPDB / IPinfo).

Verification & Severity

All fixes have been validated against the provided Proof-of-Concept parameters. The read plane, client credential storage, and shell interface are now fully isolated and hardened. Separate CVE records have been requested to credit the contributing researchers.

Target Release: v0.5.2

---

This discussion was created from the release Beta 5.2.

[SubleXBle]

Full list of changed files:

Helper-Scripts/manage-users.sh
Helper-Scripts/manage-clients.sh
Web-UI/includes/actions/action_report-ip.php
Web-UI/includes/actions/reports/abuseipdb.php
Web-UI/includes/actions/reports/ipinfo.php
Backend/multi/syncback.sh
Backend/multi/fail2ban_log2json.sh
Docs/Adding-Clients.md
Web-UI/includes/auth.php
Web-UI/includes/header.php

[SubleXBle]

Hi everyone, 

As you know, the recent v0.5.2 release fixed several critical security vulnerabilities across the dashboard, client sync, and helper scripts. First of all, thank you to everyone who updated their installations so quickly! 

I want to briefly address the way these vulnerabilities were disclosed. Immediately after releasing the patches, I published the full security advisories and updated the README/Changelog with the exact technical details of the bugs. 

Looking back, publishing these deep technical details so quickly did not give all of our users enough time to patch their systems before the vulnerabilities became common knowledge. I sincerely apologize for this rushed timeline.

While the goal was full transparency, I realize that it could have put unpatched instances at unnecessary risk. 

Moving forward, I will adopt a Coordinated Vulnerability Disclosure (CVD) approach for any future security issues. This means: 

1. Critical patches will be released immediately with a high-level, non-specific description of the security impact.
2. We will grant a "grace period" of 1 to 2 weeks to allow the community ample time to update their servers safely.
3. Full technical details and GitHub Security Advisories will only be made public after this grace period has passed.

Thank you for your ongoing support, your trust, and for helping make Fail2Ban-Report better and more secure every day. Please make sure your production instances are updated to v0.5.2 and, as always, keep the dashboard behind HTTP Basic Authentication or IP restrictions. 

Best regards,
SubleXBle