From 0effbb3569624f42550310689aaf94d726cd9d0e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Sun, 3 Sep 2017 16:14:53 +0200 Subject: [PATCH] fix WebUI system information leak MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Disable unauthenticated access to cgi-bin/credits.cgi. The page leaks the currently installed version of IPFire and the hardware architecture. Both information might make a successful attack much easier. This issue can be reproduced by accessing https://[IPFire-IP]:444/cgi-bin/credits.cgi and accepting a SSL certificate warning (if any). Signed-off-by: Peter Müller Signed-off-by: Michael Tremer --- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 4 ---- config/httpd/vhosts.d/ipfire-interface.conf | 4 ---- 2 files changed, 8 deletions(-) diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index daac75742d..4897d56d28 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -42,10 +42,6 @@ Satisfy Any Allow from All - - Satisfy Any - Allow from All - Require user admin diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf index 8783c632bb..c7c05972ed 100644 --- a/config/httpd/vhosts.d/ipfire-interface.conf +++ b/config/httpd/vhosts.d/ipfire-interface.conf @@ -34,10 +34,6 @@ Satisfy Any Allow from All - - Satisfy Any - Allow from All - Require user admin -- 2.39.2