Prevent unauthenticated access to processors #13175

Merged
merged 1 commit into from Nov 14, 2016

Projects

None yet

2 participants

@Mark-H
Collaborator
Mark-H commented Nov 14, 2016

First reported by Nikolay Lanets on November 7th with additional information received on November 12th/13th. Through specially crafted requests to core or third party connectors, it was possible to bypass checks for a valid token. This allowed unauthorized execution of certain core processors that had no other specific permission checks, but were intended for manager use only.

This vulnerability could be combined with other issues identified recently to allow further unauthorized access to the database.

Certain third party extras require unauthorized access to specific (third party) processors; for this purpose the MODX_REQP constant (set to false in their connector) can continue to be used.

@Mark-H Mark-H Prevent unauthenticated access to processors
First reported by Nikolay Lanets on November 7th with additional information received on November 12th/13th. Through specially crafted requests to core or third party connectors, it was possible to bypass checks for a valid token. This allowed unauthorized execution of certain core processors that had no other specific permission checks, but were intended for manager use only.

This vulnerability could be combined with other issues identified recently to allow further unauthorized access to the database.

Certain third party extras require unauthorized access to specific (third party) processors; for this purpose the MODX_REQP constant (set to false in their connector) can continue to be used.
19836b7
@opengeek opengeek was assigned by Mark-H Nov 14, 2016
@opengeek opengeek merged commit 19836b7 into modxcms:2.5.x Nov 14, 2016

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details
@opengeek opengeek added a commit that referenced this pull request Nov 14, 2016
@opengeek opengeek [SECURITY] Prevent unauthenticated access to processors [#13175]
Merge remote-tracking branch 'origin/pr/13175' into 2.5.x

* origin/pr/13175:
  Prevent unauthenticated access to processors
36bcd79
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment