Summary
When using the web control panel, the home page will hardcode the token string, and this behavior leads to leakage of the token.
PoC
Since the Log component of the amis template does not use a global adapter, it cannot automatically add tokens to the headers. A hard-coded token string is used to solve this problem when building the home page.
|
"headers": {"token": Config.WEB_SECRET_KEY}, |
"source": {
"url": "/pagermaid/api/log?num=${log_num | raw}",
"method": "get",
"dataType": "json",
"qsOptions": {
"arrayFormat": "indices",
"encodeValuesOnly": true
},
"headers": {
"token": "${token}"
},
"replaceData": false
},The issue was successfully resolved after using this method. It also causes a leak in the token string.
The workaround is to work around this by also using a cookie to validate the token string passed on the user's side.
Impact
The web console token has been compromised, affecting all users who have the web console open and publicly accessible
Patches
This issue has been resolved, please update to version 1.4.14.
Workarounds
It is recommended that you upgrade to the latest version, if you do not want to upgrade, please close the web console or disable public access.
Summary
When using the web control panel, the home page will hardcode the token string, and this behavior leads to leakage of the token.
PoC
Since the Log component of the amis template does not use a global adapter, it cannot automatically add tokens to the headers. A hard-coded token string is used to solve this problem when building the home page.
PagerMaid-Pyro/pagermaid/web/pages/home_page.py
Line 46 in 2b37f95
The issue was successfully resolved after using this method. It also causes a leak in the token string.
The workaround is to work around this by also using a cookie to validate the token string passed on the user's side.
Impact
The web console token has been compromised, affecting all users who have the web console open and publicly accessible
Patches
This issue has been resolved, please update to version 1.4.14.
Workarounds
It is recommended that you upgrade to the latest version, if you do not want to upgrade, please close the web console or disable public access.