CVE-2023-25570 (Markdown, published 2023-02-20T16:15Z)
Description: value: Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice. Login authentication for eureka was added in version 2.1.0. As a workaround, avoid exposing apollo-configservice to the internet.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/apolloconfig/apollo
Files changed:
CHANGES.md
apollo-configservice/src/main/java/com/ctrip/framework/apollo/configservice/ConfigServerEurekaServerConfigure.java
apollo-configservice/src/test/java/com/ctrip/framework/apollo/configservice/controller/TestWebSecurityConfig.java
docs/en/deployment/distributed-deployment-guide.md
docs/en/usage/apollo-user-guide.md
docs/zh/deployment/distributed-deployment-guide.md
docs/zh/usage/apollo-user-guide.md
Commit message: Enable login authentication for eureka


Vulnerable code:
@Order(99)
3. 1.7.1 and above can consider enabling [access control](en/deployment/distributed-deployment-guide?id=_326-admin-servicesaccesscontrolenabled-configure-whether-apollo-adminservice-has-access-control-enabled) for `apollo-adminservice`, so that only [controlled](en/deployment/distributed-deployment-guide?id=_3112-admin-servicesaccesstokens-set-the-access-token-required-by-apollo-portal-to-access-the-apollo-adminservice-for-each-environment) `apollo-portal` can access the corresponding interface to enhance security

Fixed code:
* [Enable login authentication for eureka](https://github.com/apolloconfig/apollo/pull/4663)
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configurers.provisioning.InMemoryUserDetailsManagerConfigurer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

  @Order(99)
  @Configuration
  static class EurekaServerSecurityConfigurer extends WebSecurityConfigurerAdapter {

    private static final String EUREKA_ROLE = "EUREKA";

    @Value("${apollo.eureka.server.security.enabled:false}")
    private boolean eurekaSecurityEnabled;
    @Value("${apollo.eureka.server.security.username:}")
    private String username;
    @Value("${apollo.eureka.server.security.password:}")
    private String password;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable();
      http.httpBasic();
      if (eurekaSecurityEnabled) {
        http.authorizeRequests()
            .antMatchers("/eureka/apps/**", "/eureka/instances/**", "/eureka/peerreplication/**")
            .hasRole(EUREKA_ROLE)
            .antMatchers("/**").permitAll();
      }
    }

    @Autowired
    public void configureEurekaUser(AuthenticationManagerBuilder auth) throws Exception {
      if (!eurekaSecurityEnabled) {
        return;
      }
      InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder> configurer = auth
          .getConfigurer(InMemoryUserDetailsManagerConfigurer.class);
      if (configurer == null) {
        configurer = auth.inMemoryAuthentication();
      }
      configurer.withUser(username).password(password).roles(EUREKA_ROLE);
    }
  }
@Order(98)

### 3.2.9 apollo.eureka.server.security.enabled - Configure whether to enable Eureka login authentication

> For version 2.1.0 and above

The default value is false, if you want to improve security (such as when apollo is exposed to the public network), you can enable login authentication for eureka by setting this configuration to true.

Note that if eureka login authentication is enabled, the addresses in [eureka.service.url](#_321-eurekaserviceurl-eureka-service-url) needs to be configured with a user name and password, such as:

```
http://some-user-name:some-password@1.1.1.1:8080/eureka/, http://some-user-name:some-password@2.2.2.2:8080/eureka/
```

Among them, `some-user-name` and `some-password` need to be consistent with the configuration items of `apollo.eureka.server.security.username` and `apollo.eureka.server.security.password`.

### 3.2.10 apollo.eureka.server.security.username - Configure the username of Eureka server

> For version 2.1.0 and above

Configure the login username of eureka server, which needs to be used together with [apollo.eureka.server.security.enabled](#_329-apolloeurekaserversecurityenabled-configure-whether-to-enable-eureka-login-authentication).

> Note that the username cannot be configured as apollo.

### 3.2.11 apollo.eureka.server.security.password - Configure the password of Eureka server

> For version 2.1.0 and above

Configure the login password of eureka server, which needs to be used together with [apollo.eureka.server.security.enabled](#_329-apolloeurekaserversecurityenabled-configure-whether-to-enable-eureka-login-authentication).
3. version 1.7.1 and above can consider enabling [access control](en/deployment/distributed-deployment-guide?id=_326-admin-servicesaccesscontrolenabled-configure-whether-apollo-adminservice-has-access-control-enabled) for `apollo-adminservice`, so that only [controlled](en/deployment/distributed-deployment-guide?id=_3112-admin-servicesaccesstokens-set-the-access-token-required-by-apollo-portal-to-access-the-apollo-adminservice-for-each-environment) `apollo-portal` can access the corresponding interface to enhance security
4. version 2.1.0 and above can consider enabling [access control](en/deployment/distributed-deployment-guide?id=_329-apolloeurekaserversecurityenabled-configure-whether-to-enable-eureka-login-authentication) for `eureka`, so that only controlled `apollo-configservice` and `apollo-adminservice` can be registered to `eureka` to enhance security

### 3.2.9 apollo.eureka.server.security.enabled - 配置是否开启eureka server的登录认证

> 适用于2.1.0及以上版本

默认为false，如果希望提升安全性（比如公网可访问的场景），可以设置该配置项为true启用登录认证。

需要注意的是，开启登录认证后，[eureka.service.url](#_321-eurekaserviceurl-eureka服务url)中的地址需要配置用户名和密码，如：

```
http://some-user-name:some-password@1.1.1.1:8080/eureka/,http://some-user-name:some-password@2.2.2.2:8080/eureka/
```
其中`some-user-name`和`some-password`需要和`apollo.eureka.server.security.username`以及`apollo.eureka.server.security.password`的配置项一致。

### 3.2.10 apollo.eureka.server.security.username - 配置eureka server的登录用户名

> 适用于2.1.0及以上版本

配置eureka server的登录用户名，需要和[apollo.eureka.server.security.enabled](#_329-apolloeurekaserversecurityenabled-配置是否开启eureka-server的登录认证)一起使用。

> 注意用户名不能配置为apollo

### 3.2.11 apollo.eureka.server.security.password - 配置eureka server的登录密码

> 适用于2.1.0及以上版本

配置eureka server的登录密码，需要和[apollo.eureka.server.security.enabled](#_329-apolloeurekaserversecurityenabled-配置是否开启eureka-server的登录认证)一起使用。
4. 2.1.0及以上版本可以考虑为`eureka`开启[访问控制](zh/deployment/distributed-deployment-guide?id=_329-apolloeurekaserversecurityenabled-配置是否开启eureka-server的登录认证)，从而只有受控的`apollo-configservice`和`apollo-adminservice`可以注册到`eureka`，增强安全性