| Título | Maltrail 3.0.1 Missing Authentication |
|---|
| Descripción | The Maltrail reporting server (core/httpd.py) exposes the endpoint /blacklist, which reads the current day's event log and returns the internal source IP addresses flagged by the operator's BLACKLIST rules. Through version 3.0.1 the handler _blacklist() performed no authentication and no authorization: a remote unauthenticated attacker able to reach the reporting server's HTTP port (default 8338; HTTP_ADDRESS defaults to x.x.x.x) could issue a single GET /blacklist request and receive those flagged internal addresses. The vendor's own 3.1 CHANGELOG describes it: the endpoint "reads the event log and returned the flagged source IPs to anyone". This was the only log-reading endpoint of the server lacking the access control its siblings enforce: /events, /live, /counts, /geo, /hunt, /meta and /reference all require an authenticated session, and the near-identical /fail2ban endpoint is restricted by the FAIL2BAN_ALLOWLIST option; /blacklist enforced neither. Affected file: core/httpd.py, function _blacklist. Attack: unauthenticated GET /blacklist (also /blacklist/). Vulnerability class: Missing Authentication (CWE-306), impact Information Disclosure (CWE-200). CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium). The vendor fixed it the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new BLACKLIST_ALLOWLIST option (commit d95868df). Affected: up to and including 3.0.1. Fixed: 3.1. |
|---|
| Fuente | ⚠️ https://gist.github.com/simyat/fd48e9c257ab95405c109aec575977f1 |
|---|
| Usuario | inmoyang (UID 89515) |
|---|
| Sumisión | 2026-08-15 16:38 (hace 1 mes) |
|---|
| Moderación | 2026-09-14 17:38 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 403583 [stamparm maltrail hasta 3.0.1 Blacklist Endpoint core/httpd.py _blacklist autenticación débil] |
|---|
| Puntos | 20 |
|---|