Security Advisory: Fixes for IDOR, Auth Bypass, Stored XSS, and Hardening

Vulnerability Overview This version (v1.4.0) includes fixes for multiple security vulnerabilities, primarily involving access control, authentication, content injection, and deployment security. Affected Scope Access Control and Tenant Isolation: - Cross-workspace resource lookup was not properly restricted, potentially leading to IDOR (Insecure Direct Object Reference) vulnerabilities. - Workspace member operations were not properly restricted, potentially leading to unauthorized access. - Estimation point creation and deletion were not properly restricted, potentially leading to unauthorized operations. - Workspace member permission checks were not properly restricted, potentially leading to unauthorized access. - Workspace asset read and write operations were not properly restricted, potentially leading to unauthorized access. - Workspace-level cycle and module lists were not properly restricted, potentially leading to unauthorized access. - Project page version permissions were not properly restricted, potentially leading to unauthorized access. - Project member permission checks were not properly restricted, potentially leading to unauthorized access. - Guest user access restrictions were not properly enforced, potentially leading to unauthorized access. - Project administrator permissions were not properly restricted, potentially leading to unauthorized access. - Project ID validation was not properly enforced, potentially leading to unauthorized access. Authentication and Invitations: - Login for disabled accounts was not properly restricted, potentially leading to unauthorized access. - Integration logging was not properly restricted, potentially leading to unauthorized access. - API key authentication was not properly restricted, potentially leading to unauthorized access. - OAuth provider email handling was not properly restricted, potentially leading to unauthorized access. - Magic code verification was not properly restricted, potentially leading to unauthorized access. - Workspace invitation tokens were not properly restricted, potentially leading to unauthorized access. - Project invitation endpoints were not properly restricted, potentially leading to unauthorized access. - Instance administrator registration was not properly restricted, potentially leading to unauthorized access. Injection and Content Security: - HTML in comments and ingestion descriptions was not properly filtered, potentially leading to Stored XSS vulnerabilities. - Script-uploaded files were not properly filtered, potentially leading to Stored XSS vulnerabilities. - Links were not properly filtered, potentially leading to unauthorized access. - Allowed sorting parameters were not properly filtered, potentially leading to unauthorized access. - XLSX export cells were not properly filtered, potentially leading to unauthorized access. - Webhook delivery, work item links, and OAuth avatar retrieval were not properly filtered, potentially leading to unauthorized access. - Environment variables were not properly filtered, potentially leading to unauthorized access. Secrets and Deployment: - Default keys were not properly protected, potentially leading to unauthorized access. - API keys were not properly protected, potentially leading to unauthorized access. - Docker images were not properly protected, potentially leading to unauthorized access. Remediation Access Control and Tenant Isolation: - Restrict cross-workspace resource lookups to ensure only the requester has access. - Restrict workspace member operations to ensure only the requester has permission to operate. - Restrict estimation point creation and deletion to ensure only the requester has permission to operate. - Restrict workspace member permission checks to ensure only the requester has access. - Restrict workspace asset read and write operations to ensure only the requester has access. - Restrict workspace-level cycle and module lists to ensure only the requester has access. - Restrict project page version permissions to ensure only the requester has access. - Restrict project member permission checks to ensure only the requester has access. - Restrict guest user access to ensure only the requester has access. - Restrict project administrator permissions to ensure only the requester has access. - Validate project IDs to ensure only the requester has access. Authentication and Invitations: - Restrict login for disabled accounts to ensure only the requester has access. - Restrict integration logging to ensure only the requester has access. - Restrict API key authentication to ensure only the requester has access. - Restrict OAuth provider email handling to ensure only the requester has access. - Restrict magic code verification to ensure only the requester has access. - Restrict workspace invitation tokens to ensure only the requester has access. - Restrict project invitation endpoints to ensure only the requester has access. - Restrict instance administrator regis

Goal Reached Thanks to every supporter — we hit 100%!

Security Advisory: Fixes for IDOR, Auth Bypass, Stored XSS, and Hardening

More from this source