Hi,
We got multiple security reports related to missing access permissions
and I do not know if this is expected to be like this.
This for example returns all ubus actions:
> curl http://192.168.1.1/ubus/list
No authentication needed.
https://github.com/openwrt/openwrt/security/advisories/GHSA-g9vr-gg8c-pvjx
uhttpd has basic authentication support, this is not the login used by
OpenWrt, but it allows to protect some folders. This authentication only
works for files, but not for file handlers like the rpcd endpoint.
Should we do something like this:
https://github.com/openwrt/uhttpd/pull/31/changes
https://github.com/openwrt/uhttpd/security/advisories/GHSA-5cgm-8h9x-v28c
The auth code in uhttpd was very buggy.
Hauke
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
