Skip to content

v1.7.9

Choose a tag to compare

View all tags
@ShaneIsrael ShaneIsrael released this 30 Aug 16:57
· 69 commits to main since this release
v1.7.9
9bd61ad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Update

  • Fixed an authenticated SSRF (server-side request forgery) in the game asset update endpoint. The URL allowlist was validated with a different parser than the one used to fetch the asset, so a crafted URL could pass the SteamGridDB host check while causing the server to issue requests to arbitrary internal hosts and ports. Reported by @wenbo222

If you run Fireshare with LDAP auth enabled, this is exploitable by any logged-in user (including non-admins), so updating to v1.7.9 is highly recommended. Without LDAP, the endpoint requires an admin account, but upgrading is still advised.

Contributors

wenbo222
Assets 2
Loading