Algernonに認可回避の脆弱性、1.17.10で修正
Summary
WindowsやmacOSでWebサーバーのAlgernonを動かしている組織が対象で、URLの大文字小文字を変えるだけで /admin などの認可を認証なしに回避される脆弱性です。1.17.10へ更新し、アクセスログに不審な形跡がないかも確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WindowsやmacOSでWebサーバーのAlgernonを動かしている組織が対象で、URLの大文字小文字を変えるだけで /admin などの認可を認証なしに回避される脆弱性です。1.17.10へ更新し、アクセスログに不審な形跡がないかも確認してください。
Original description The description as published by the source.
Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com