CVE-2020-36623 (published 2022-12-21T19:15Z)

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/jtojnar/pengu
commit_details: repo_url: https://github.com/jtojnar/pengu
author: Jan Tojnar
author_date: 2020-11-02 14:31:56+01:00
msg: Add origin whitelist

To prevent CSRF attack.
repository: repo_url: https://github.com/jtojnar/pengu
repo_name: jtojnar/pengu
repo_language: JavaScript
owner: jtojnar
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,7 @@ pengu uses the following environment variables for configuration:
 * `DATABASE_URL` – [Connection string](https://node-postgres.com/features/connecting/#connection-uri) for the PostgreSQL database. If omitted, persistence will be missing.
 * `NODE_ENV` – Can be set to `production` for less verbose logs. Defaults to `development`.
 * `OPENID_PROVIDER` – If this is set, pengu will use OpenID to log-in. Though it only supports using a hardcoded identity specified by this variable. User will be redirected to the provider, where they will confirm their credentials, and then be redirected back to Pengu with an access code. Pengu will then verify the access code against the OpenID verification URL and realm specified by `OPENID_VERIFY`, `OPENID_REALM` environment variables.
+* `ACCEPTED_ORIGINS` – comma-separated list of domain names that are allowed to access the WebSockets server. This is necessary to prevent [cross-site request forgery](https://en.wikipedia.org/wiki/WebSocket#Security_considerations). When the environment variable is not set, only `localhost` and `127.0.0.1` will be allowed to connect.
 
 ## Development
 

programming_language: Markdown
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@ function findById(arr, id) {
 	return null;
 }
 
+const acceptedOrigins = process.env.ACCEPTED_ORIGINS ? process.env.ACCEPTED_ORIGINS.split(',') : ['localhost', '127.0.0.1'];
+
 async function runApp() {
 	let app = express();
 
@@ -68,8 +70,9 @@ async function runApp() {
 		autoAcceptConnections: false
 	});
 
-	function originIsAllowed() {
-		return true;
+	function originIsAllowed(origin) {
+		const url = new URL(origin);
+		return acceptedOrigins.includes(url.hostname);
 	}
 
 	let clients = [];

programming_language: TypeScript