Description
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
semaphoreui semaphore
Default version status: unaffected
0 to ≤ 2.19.12affected
pkg:golang/github.com/semaphoreui/semaphoreReferences
- https://github.com/semaphoreui/semaphore/issues/4150 ↗
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106 ↗
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329 ↗
- https://github.com/semaphoreui/semaphore ↗
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests ↗