Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ssl] possible Vuln. #20

Open
Bizarrus opened this issue Nov 9, 2023 · 0 comments
Open

[ssl] possible Vuln. #20

Bizarrus opened this issue Nov 9, 2023 · 0 comments
Labels
bug Something isn't working security security behavior

Comments

@Bizarrus
Copy link
Member

Bizarrus commented Nov 9, 2023

Currently, when certificates will be created, the system checks not the permission of domain (Does the user own the domain?), located at following Lines:

If a certificate is added manually, the certificate is currently not completely checked for validity:

Possible behavior

  • XSS may allow a certificate to be added to a domain even though the user currently logged in does not own this domain.
  • If the certificate is faulty (as it is not currently being intensively checked for validity), the apache2 web server may refuse to provide the service.
@Bizarrus Bizarrus added bug Something isn't working security security behavior labels Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working security security behavior
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Bizarrus