Skip to content

2.5.2 — security: unauthenticated RCE fix

Choose a tag to compare

View all tags
@gumslone gumslone released this 29 Jul 22:11
· 51 commits to master since this release
2.5.2
b8deb4f

🔒 Security release — please upgrade

Fixes an unauthenticated remote command execution vulnerability (CVSS 3.1 9.8, CWE-306 / CWE-1188).
Reported by Dhaiwat Mehta.

The problem

GumCP shipped with authentication disabled by default — LOGIN_REQUIRED and BASIC_AUTH were both false. A default install therefore exposed the entire panel, including execute_command.php and the button execute action, to anyone who could reach it over the network.

Those endpoints were protected only by a CSRF token, which is not an access control: a token is minted for every session (authenticated or not) and embedded in the page HTML, so a direct attacker simply reads it. Commands run over SSH as SSH_USER, which the install guide gives passwordless sudo — making this unauthenticated command execution as root.

The fix

  • Fails closed. A new shipped include/auth.php holds the access gate, consulted by include/init.php on every page and endpoint. With no authentication configured, GumCP now refuses to serve and shows setup instructions instead of the panel.
  • The gate moved into shipped code. It previously lived in the user-owned include/config.php, which is git-ignored and never updated on upgrade — so no fix shipped there could have reached existing installs.
  • LOGIN_REQUIRED now defaults to true.
  • An open panel now requires deliberately setting GUMCP_ALLOW_UNAUTHENTICATED = true, and shows a red warning banner on every page.
  • A warning banner also appears while a shipped default password is still in use.
  • System Check gained a Security section (auth configured / open access disabled / credentials changed).

⚠️ Action required

If your config.php had LOGIN_REQUIRED = false, GumCP will show a setup page until you configure a login:

define('LOGIN_REQUIRED', true);
define('LOGIN_USER', 'your-username');
define('LOGIN_PASS', 'a-long-unique-password');

Also change any default password, and never expose GumCP directly to the internet.

Upgrading

cd /var/www/html/GumCP && sudo git pull origin master
Assets 2
Loading