[ZBX-15146] Information disclosure vulnerability when using a ipv6 address to login Created: 2018 Nov 08  Updated: 2024 Apr 10  Resolved: 2018 Dec 13

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: API (A)
Affects Version/s: 4.0.1
Fix Version/s: 3.0.25rc1, 4.0.3rc1, 4.2.0alpha2, 4.2 (plan)

Type: Problem report Priority: Major
Reporter: Adrian Kirchner Assignee: Miks Kronkalns
Resolution: Fixed Votes: 0
Labels: frontend
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: PNG File screenshot.png    
Team: Team B
Sprint: Sprint 46, Nov 2018, Sprint 47, Dec 2018
Story Points: 0.5

 Description   

Steps to reproduce:

  1. Use an ipv6 internet connection
  2. Navigate to login screen
  3. Use a valid username with a wrong password
  4. Click "Sign in"

Result:
See screenshot...

This in fact an information disclosure vulnerability, since you can search for existing user accounts that way. I asked for an alternative way to submit this issue, but didn't get an answer for about two weeks.

 Comments   
Comment by Edgars Melveris [ 2018 Nov 09 ]

Hello Adrian!

Thanks for reporting this issue, confirmed.

Comment by Miks Kronkalns [ 2018 Nov 14 ]

Fixed in development branches:

  • 3.0 - svn://svn.zabbix.com/branches/dev/ZBX-15146
  • 4.0 - svn://svn.zabbix.com/branches/dev/ZBX-15146_40
Comment by Miks Kronkalns [ 2018 Nov 28 ]

Fixed in:

  • 3.0.25rc1 r87333
  • 4.0.3rc1 r87336
  • 4.2.0alpha2 (trunk) r87337
Comment by richlv [ 2018 Nov 29 ]

Thank you for the revision information. It looks like the same solution was chosen for all branches, for example trunk:

-                                       'attempt_ip' => $db_user['userip']
+                                       'attempt_ip' => substr($db_user['userip'], 0, 39)

a) Wouldn't trunk need DB schema change so that the failed login IP can be recorded fully?
b) Shouldn't this IP trimming be documented in known issues for versions where that is going to happen?

Comment by Miks Kronkalns [ 2018 Nov 29 ]

Thank you richlv for your suggestion.

We decided to store only 39 characters of IP address for all supported versions and trunk, so, no need to make changes in DB schema. And yes, we will make appropriate record in known issues page. Thank you!

Generated at Thu Apr 25 09:36:23 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.