Authelia v3.21.0 Patches: Disable Login Server, TLS Logging, and Hardcoded Config Vulnerabilities

Based on the provided screenshot, here is a summary of the security vulnerability fixes included in this version update: Vulnerability Overview This update (v3.21.0) primarily addresses the following security vulnerabilities: 1. Disable Login Server: Fixed a vulnerability that allowed the login server to be disabled. 2. Disable TLS Logging: Fixed a vulnerability that allowed TLS logging to be disabled. 3. Hardcoded Public Configuration: Fixed a vulnerability that allowed HTTP and server-side public configurations to be hardcoded. Scope of Impact Versions: Versions prior to v3.21.0 (specific affected versions are not explicitly listed, but the fix content implies these configuration vulnerabilities existed in older versions). Components: - Login server configuration - TLS logging functionality - Public configuration (HTTP and server-side) Remediation Disable Login Server: Updated code logic to ensure the login server cannot be arbitrarily disabled. Disable TLS Logging: Updated code logic to ensure TLS logging functionality cannot be arbitrarily disabled. Hardcoded Public Configuration: Updated code logic to prevent public configurations (HTTP and server-side) from being hardcoded. POC or Exploitation Code No POC code or exploitation code is included in the screenshot. Other Security-Related Updates Strengthened Login Method Policies: - Form login, Basic authentication, and OAuth login now mandate the configuration of a two-factor authentication method flag. - Direct requests to disable two-factor authentication are no longer affected by (in external authentication or OIDC flows). Strengthened Login Rate Limiting: - Login rate limiting now applies source-based failed attempt limits in addition to checking source or origin and origin unused limits. - Rotating usernames from the same source are no longer subject to source-based failed attempt limits. Hardcoded Public Configuration Hardening: - Public configurations are now server-side filtered before being returned to the client. - Existing log filtering, inline formatting, and secure links have been preserved. Upgrade Considerations Disabling Login Methods at Deployment: At least one login method must be enabled in the Admin Panel; otherwise, direct API calls will fail. Proxy Deployment: Deployments behind a reverse proxy should verify trusted Proxy Header settings to ensure rate limiting is based on the user's real IP address rather than the proxy's address. Font Boundary Protection: Secure text, inline formatting, and secure links are now permitted; active or embedded HTML is not supported and has been stripped.

Goal Reached Thanks to every supporter — we hit 100%!

Authelia v3.21.0 Patches: Disable Login Server, TLS Logging, and Hardcoded Config Vulnerabilities

More from this source