Hermes WebUI Vulnerability Fixes: X-Forwarded-For Trust Bypass, CSRF on Update Check, and Media Access Control

Vulnerability Overview This vulnerability concerns security-sensitive default configuration issues within the WebUI, primarily affecting the following aspects: 1. Trust issues with the X-Forwarded-For header: Unauthenticated local network requests may bypass security restrictions by forging X-Forwarded-For headers. 2. Lack of password protection during Docker startup: Docker starts in password-less mode by default, posing a security risk. 3. CSRF vulnerability in update checks: The endpoint lacks CSRF protection, potentially allowing malicious requests. 4. Media file access permissions: Media files in the directory may be accessible without authorization. Scope of Impact Trust issues with the X-Forwarded-For header: Affects all unauthenticated local network requests. Lack of password protection during Docker startup: Affects all Docker instances running with default configurations. CSRF vulnerability in update checks: Affects all users utilizing the endpoint. Media file access permissions: Affects all users accessing media files within the directory. Remediation Plan 1. Trust issues with the X-Forwarded-For header: - Trust the X-Forwarded-For header only when is set. - Use as a fallback option. 2. Lack of password protection during Docker startup: - Enable password protection by default, unless explicitly disabled. - Hide password and session information in logs. 3. CSRF vulnerability in update checks: - Change to and add CSRF protection. - Update relevant calls to accommodate the new interface. 4. Media file access permissions: - Remove access permissions to media files in the directory, unless granted via session media or explicitly set through . POC Code The above code blocks illustrate comparisons between pre-fix and post-fix implementations. For detailed implementation specifics, please refer to the complete code in the PR.

Goal Reached Thanks to every supporter — we hit 100%!

Hermes WebUI Vulnerability Fixes: X-Forwarded-For Trust Bypass, CSRF on Update Check, and Media Access Control

More from this source