CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS
Percentile
49.4%
Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no custom authorization filters specified, LocalRequestsOnlyAuthorizationFilter
filter is being used to allow only local requests and prohibit all the remote requests to provide sensible, protected by default settings.
However due to the recent changes, in version 1.7.25 no authorization filters are used by default, allowing remote requests to succeed.
Missing authorization when default options are used for the Dashboard UI, e.g. when no custom authorization rules are used as recommended in the Using Dashboard documentation article.
If you are using UseHangfireDashboard
method with default DashboardOptions.Authorization
property value, then your installation is impacted:
app.UseHangfireDashboard(); // Impacted
app.UseHangfireDashboard("/hangfire", new DashboardOptions()); // Impacted
If any other authorization filter is specified in the DashboardOptions.Authorization
property, the you are not impacted:
app.UseHangfireDashboard("/hangfire", new DashboardOptions
{
Authorization = new []{ new SomeAuthorizationFilter(); } // Not impacted
});
Patch is already available in version 1.7.26 and already available on NuGet.org, please see Hangfire.Core 1.7.26. Default authorization rules now prohibit remote requests by default again by including the LocalRequestsOnlyAuthorizationFilter
filter to the default settings. Please upgrade to the newest version in order to mitigate the issue.
It is possible to fix the issue by using the LocalRequestsOnlyAuthorizationFilter
explicitly when configuring the Dashboard UI. In this case upgrade is not required.
// using Hangfire.Dashboard;
app.UseHangfireDashboard("/hangfire", new DashboardOptions
{
Authorization = new []{ new LocalRequestsOnlyAuthorizationFilter(); }
});
Original GitHub Issue: https://github.com/HangfireIO/Hangfire/issues/1958
Vendor | Product | Version | CPE |
---|---|---|---|
* | hangfire.core | 1.7.25 | cpe:2.3:a:*:hangfire.core:1.7.25:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS
Percentile
49.4%