RCE vulnerability in default applications

[shaolin-tw]

There are two vulnerabilities in sample code. A production server contained default applications could cause Remote Code Execution attack. The official site (web2py.com) is also affected.

According to the policy of Reporting Security Bugs, I can't describe more detail. To those web2py users: REMOVE default applications in production server is the safe way.

[jicho]

@shaolin-tw do you mean the example and welcome applications? Just to be sure :)

[shaolin-tw]

@jicho yes, exactly!

[jicho]

@shaolin-tw thanks :)

[shaolin-tw]

Hi All,
Could anyone tell me who should I contact to describe this issue? I sent email to mdipierro but no response. It is a serious problem. Attacker can hack web2py.com by these vulnerabilities directly.

Thanks

[mdipierro]

was in spam. responding now.

[BuhtigithuB]

Does that include Admin app and appadmin?

On Mon, Mar 14, 2016 at 1:29 PM, mdipierro notifications@github.com wrote:

was in spam. responding now.

—
Reply to this email directly or view it on GitHub
#1205 (comment).

[mdipierro]

The problem is an information leak in one of the examples in the examples app.
If you publish the examples app using rocket it may expose your admin password.
This is because the purpose of the example was to dump the internal status of web2py.

If you remove the examples app from your production deployment, you are safe.
If you use a third party web server like nginx or apache you are also safe (and you should do that anyway in production).

The fix in trunk is twofold. 1) we remove the specific example that caused the information leak. 2) we changed some internals in order to prevent this from happening again.

Massimo

On Mar 15, 2016, at 8:20 AM, BuhtigithuB notifications@github.com wrote:

Does that include Admin app and appadmin?

On Mon, Mar 14, 2016 at 1:29 PM, mdipierro notifications@github.com wrote:

was in spam. responding now.

—
Reply to this email directly or view it on GitHub
#1205 (comment).

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
#1205 (comment)

[mdipierro]

we have discussed this and decided to: 1) remove the example that exposes internals from the examples app. 2) remove the password from the global_settings.