Aman-Mittal opened a new issue, #214:
URL: https://github.com/apache/fineract-backoffice-ui/issues/214
Part of the GA security hardening work.
## Summary
`ConfigService.setApiUrl()` writes whatever it is given straight into the
running config and into
local storage:
```ts
setApiUrl(url: string): void {
this._config.update((config) => ({ ...config, fineractApiUrl: url }));
this.storage.write('runtimeConfig', { fineractApiUrl: url });
}
```
There is no validation. The stored value is also read back on the next load
and applied over the
deployment's own `config.json`.
## Business value
**Whatever this names receives the user's credentials on their next
sign-in.**
The override exists for a good reason — an operator pointing the application
at their own Fineract
— but as written it is a general redirect. Two routes to abuse:
- Anything running as the page can call it, or write the local-storage key
directly, and the
choice survives a reload. Combined with the unrestricted `Authorization`
header, the next login
posts real credentials to the attacker's host.
- A user can be talked into pasting a URL into the endpoint field. It looks
like configuration,
not like a credential handover.
Local storage is writable by anything running as the page, so a stored
override cannot be treated
as more trustworthy than a fresh one.
## Scope
Validate against an allow-list. Same-origin endpoints are always permitted;
an absolute one must
match this document's origin or an origin the deployment named in
`config.json`. Refuse anything
else, both when set and when read back from storage. The setter reports
refusal so callers can
surface it rather than silently continuing.
## Acceptance criteria
- [ ] A same-origin endpoint is accepted and persisted.
- [ ] An absolute endpoint not on the allow-list is refused, and nothing is
persisted.
- [ ] An absolute endpoint the deployment allow-listed is accepted.
- [ ] A stored endpoint that is not allow-listed is ignored on load.
- [ ] The login form refuses before authenticating, so the password never
reaches an unsanctioned
host, and explains why.
- [ ] Unit tests cover each case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
