CVE-2023-33960: OpenProject vulnerable to project identifier information leakage through robots.txt
OpenProject is web-based project management software. For any OpenProject installation, a robots.txt file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as Login required and prevents all truly anonymous access, the /robots.txt route remains publicly available.
Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 12.5.6 - Configuration
As a workaround, mark any public project as non-public and grant access to users via project membership.
OpenProject Public project visibility (mark project as non-public) = non-public - Configuration
Ensure the entire OpenProject instance is marked as `Login required` to prevent truly anonymous access (note: this does not fix `/robots.txt` prior to 12.5.6).
OpenProject Instance access restriction (Login required) = enabled - Compensating control
Restrict crawler access to `/robots.txt` at the network/WAF level so that project identifiers are not disclosed through publicly accessible `robots.txt` (especially for OpenProject versions prior to 12.5.6).
Event History
Frequently Asked Questions
What is the vulnerability CVE-2023-33960?
CVE-2023-33960 is a vulnerability in OpenProject that exposes project identifiers of public projects through a generated robots.txt file.
What is the severity of CVE-2023-33960?
CVE-2023-33960 has been rated as a moderate severity vulnerability due to its potential exposure of sensitive project information.
Who is affected by CVE-2023-33960?
CVE-2023-33960 affects all OpenProject installations up to version 12.5.6 that create a default robots.txt file.
How do I fix CVE-2023-33960?
To fix CVE-2023-33960, update OpenProject to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2023-33960?
The potential impacts of CVE-2023-33960 include unauthorized access to project identifiers, which could lead to further probing or exploitation of project data.