Baymax-armed opened a new issue, #4382:
URL: https://github.com/apache/hertzbeat/issues/4382
### Background
Authoring a monitoring type via `POST /api/apps/define/yml` is available to
the non-admin `user` role (`/api/apps/**===post===[admin,user]` in
`sureness.yml`). A template can set `protocol: script` with an arbitrary
`scriptCommand`, which `ScriptCollectImpl.collect` runs via `new
ProcessBuilder("bash","-c", scriptCommand)`
(`hertzbeat-collector-basic/.../collect/script/ScriptCollectImpl.java:81`). The
import-time guard `RISKY_STR_ARR`
(`hertzbeat-manager/.../controller/AppController.java:55-59`) only blocks
Java/Groovy/deserialization tokens, and `verifyDefineAppContent` validates
structure only, so a shell command passes; it can then be run synchronously via
`POST /api/monitor/detect`.
I reported this privately to the ASF security team. They assessed it as
**within the documented trusted-user security model** (roles are not a security
boundary — "all users have management permissions"), so it is **not** a
vulnerability, and suggested raising it here as a hardening improvement aligned
with the role-enforcement work planned for 1.9.0.
### Suggested hardening
- Gate `POST /api/apps/define/yml` to admin (matching `PUT`/`DELETE`), or
under the upcoming role enforcement.
- Allowlist the collect `protocol` accepted in user-authored templates
(exclude `script`/`ssh`/command protocols), validated at import.
- Shell-escape (or strictly allowlist) `^_^param^_^` substitutions before
they enter a command.
Happy to send a PR if this direction sounds right.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail:
[email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
