fix(admin): harden localhost auth bypass and lock down admin CORS#33
Merged
Conversation
Close two Admin API issues reported by an external researcher against v0.6.5. Cross-origin localhost takeover: the localhost auth bypass trusted any loopback request, but a browser fetch() from any site also originates from loopback, and the admin CORS default echoed "*". The bypass now refuses cross-site / foreign-origin browser requests (Sec-Fetch-* with an Origin fallback) and validates the Host header against the loopback allowlist (anti-DNS-rebinding); the same gating is applied to the engine-registration endpoints. The admin CORS default allows loopback origins only. Unauthenticated exports: the dashboard-asset auth exemption matched any *.json/*.map path, exposing /openapi.json and /insomnia.json. The exemption no longer matches by those extensions. CLI/MCP keep keyless localhost access for read-only requests. Adds regression tests for the denied and allowed paths.
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
- client.go: drop trailing punctuation/newline from the relay dial error (staticcheck ST1005) - bump Go build/CI to 1.26.4 (stdlib advisories: net/textproto, crypto/x509, net/mail, html/template, net, net/http) - bump golang.org/x/net to v0.55.0 (idna + http2 advisories)
# Conflicts: # .github/workflows/benchmark.yaml # .github/workflows/ci.yaml # Dockerfile
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes two Admin API issues reported by an external researcher against v0.6.5.
Issue 1 — cross-origin localhost Admin API takeover
The localhost auth bypass trusted any request from the loopback socket, but a browser
fetch()from any site also originates from loopback, and the admin CORS default echoed*. Fix:Sec-Fetch-*headers, with anOriginfallback) and validates theHostheader against the loopback allowlist (anti-DNS-rebinding).keylessLocalhostTrustedhelper).*, nevernull.Issue 2 — unauthenticated
/openapi.jsonand/insomnia.jsonThe dashboard-asset auth exemption matched any
*.json/*.mappath, exposing the OpenAPI/Insomnia exports (full mock config) without the API key. The exemption no longer matches those extensions, consistent with the.yamltwins.Tests
Adds
pkg/admin/security_bypass_cors_test.gocovering the denied (cross-site, legacy-browser, DNS-rebinding, header-less write) and allowed (CLI, same-origin, cross-port dashboard) paths, plus predicate unit tests.go build,go vet, and thepkg/admin+pkg/tunnelsuites pass.