| 제목 | Maltrail 3.0.1 Missing Authentication |
|---|
| 설명 | The Maltrail reporting server (core/httpd.py) exposes the endpoint /blacklist, which reads the current day's event log and returns the internal source IP addresses flagged by the operator's BLACKLIST rules. Through version 3.0.1 the handler _blacklist() performed no authentication and no authorization: a remote unauthenticated attacker able to reach the reporting server's HTTP port (default 8338; HTTP_ADDRESS defaults to x.x.x.x) could issue a single GET /blacklist request and receive those flagged internal addresses. The vendor's own 3.1 CHANGELOG describes it: the endpoint "reads the event log and returned the flagged source IPs to anyone". This was the only log-reading endpoint of the server lacking the access control its siblings enforce: /events, /live, /counts, /geo, /hunt, /meta and /reference all require an authenticated session, and the near-identical /fail2ban endpoint is restricted by the FAIL2BAN_ALLOWLIST option; /blacklist enforced neither. Affected file: core/httpd.py, function _blacklist. Attack: unauthenticated GET /blacklist (also /blacklist/). Vulnerability class: Missing Authentication (CWE-306), impact Information Disclosure (CWE-200). CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium). The vendor fixed it the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new BLACKLIST_ALLOWLIST option (commit d95868df). Affected: up to and including 3.0.1. Fixed: 3.1. |
|---|
| 원천 | ⚠️ https://gist.github.com/simyat/fd48e9c257ab95405c109aec575977f1 |
|---|
| 사용자 | inmoyang (UID 89515) |
|---|
| 제출 | 2026. 08. 15. PM 04:38 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 14. PM 05:38 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403583 [stamparm maltrail 까지 3.0.1 Blacklist Endpoint core/httpd.py _blacklist 약한 인증] |
|---|
| 포인트들 | 20 |
|---|