CVE-2019-12105: Missing Authentication for Critical Function (CWE-306)
value: In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 8.2
Published: 2019-09-10T17:15Z
Repository: https://github.com/Supervisor/supervisor
Language: Other
Files changed: docs/configuration.rst, supervisor/skel/sample.conf
Commit date: 2019-06-05 11:22:51 -0700
Commit message: Add an explicit security warning about inet_http_server.
References #1245

Diff: diff --git a/docs/configuration.rst b/docs/configuration.rst
index 588c6da..69088c9 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -155,20 +155,34 @@ The :file:`supervisord.conf` file contains a section named
 HTTP server that listens on a TCP (internet) socket should be
 inserted.  If the configuration file has no ``[inet_http_server]``
 section, an inet HTTP server will not be started.  The allowable
 configuration values are as follows.
 
+.. warning::
+
+  The inet HTTP server is not enabled by default.  If you choose to enable it,
+  please read the following security warning.  The inet HTTP server is intended
+  for use within a trusted environment only.  It should only be bound to localhost
+  or only accessible from within an isolated, trusted network.  The inet HTTP server
+  does not support any form of encryption.  The inet HTTP server does not use
+  authentication by default (see the ``username=`` and ``password=`` options).
+  The inet HTTP server can be controlled remotely from :program:`supervisorctl`.
+  It also serves a web interface that allows subprocesses to be started or stopped,
+  and subprocess logs to be viewed.  **Never expose the inet HTTP server to the
+  public internet.**
+
 ``[inet_http_server]`` Section Values
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 ``port``
 
   A TCP host:port value or (e.g. ``127.0.0.1:9001``) on which
   supervisor will listen for HTTP/XML-RPC requests.
   :program:`supervisorctl` will use XML-RPC to communicate with
   :program:`supervisord` over this port.  To listen on all interfaces
-  in the machine, use ``:9001`` or ``*:9001``.
+  in the machine, use ``:9001`` or ``*:9001``.  Please read the security
+  warning above.
 
   *Default*:  No default.
 
   *Required*:  Yes.
 
diff --git a/supervisor/skel/sample.conf b/supervisor/skel/sample.conf
index 84cfc55..94e0ea2 100644
--- a/supervisor/skel/sample.conf
+++ b/supervisor/skel/sample.conf
@@ -9,10 +9,20 @@
 ;  - Quotes around values are not supported, except in the case of
 ;    the environment= options as shown below.
 ;  - Comments must have a leading space: "a=b ;comment" not "a=b;comment".
 ;  - Command will be truncated if it looks like a config file comment, e.g.
 ;    "command=bash -c 'foo ; bar'" will truncate to "command=bash -c 'foo ".
+;
+; Security Warning:
+;  The inet HTTP server is not enabled by default.  The inet HTTP server is
+;  enabled by uncommenting the [inet_http_server] section below.  The inet
+;  HTTP server is intended for use within a trusted environment only.  It
+;  should only be bound to localhost or only accessible from within an
+;  isolated, trusted network.  The inet HTTP server does not support any
+;  form of encryption.  The inet HTTP server does not use authentication
+;  by default (see the username= and password= options to add authentication).
+;  Never expose the inet HTTP server to the public internet.
 
 [unix_http_server]
 file=/tmp/supervisor.sock   ; the path to the socket file
 ;chmod=0700                 ; socket file mode (default 0700)
 ;chown=nobody:nogroup       ; socket file uid:gid owner

Vulnerable code:   in the machine, use ``:9001`` or ``*:9001``.
Fixed code: .. warning::

  The inet HTTP server is not enabled by default.  If you choose to enable it,
  please read the following security warning.  The inet HTTP server is intended
  for use within a trusted environment only.  It should only be bound to localhost
  or only accessible from within an isolated, trusted network.  The inet HTTP server
  does not support any form of encryption.  The inet HTTP server does not use
  authentication by default (see the ``username=`` and ``password=`` options).
  The inet HTTP server can be controlled remotely from :program:`supervisorctl`.
  It also serves a web interface that allows subprocesses to be started or stopped,
  and subprocess logs to be viewed.  **Never expose the inet HTTP server to the
  public internet.**

  in the machine, use ``:9001`` or ``*:9001``.  Please read the security
  warning above.
;
; Security Warning:
;  The inet HTTP server is not enabled by default.  The inet HTTP server is
;  enabled by uncommenting the [inet_http_server] section below.  The inet
;  HTTP server is intended for use within a trusted environment only.  It
;  should only be bound to localhost or only accessible from within an
;  isolated, trusted network.  The inet HTTP server does not support any
;  form of encryption.  The inet HTTP server does not use authentication
;  by default (see the username= and password= options to add authentication).
;  Never expose the inet HTTP server to the public internet.