search

QuickBox / QB

QuickBox is much more than a ‘seedbox installer script’, it is a simplistic approach to achieving easy seedbox and services management from a beautifully designed dashboard. Allowing users the ability to interact with their seedbox and server on a professional grade level.
https://quickbox.io
GNU General Public License v3.0
739 stars 171 forks source link

Responsible disclosure policy #202

Closed JamieSlome closed 2 years ago

JamieSlome commented 2 years ago

Hey there!

I belong to an open source security research community, and a member (@websecnl) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

websecnl commented 2 years ago

CVE-2021-44981

Hey there!

I belong to an open source security research community, and a member (@websecnl) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Assigned CVE so far: CVE-2021-44981

(More CVE's are to be assigned as there where a total of 5 findings reported)

JMSDOnline commented 2 years ago

Patched in both CE and Pro

omridon commented 2 years ago

hi where is the patch?

JamieSlome commented 2 years ago

@JMSDOnline - are we able to mark the report as valid and fixed appropriately, if the issue on the report is fixed?

https://huntr.dev/bounties/c4b4b746-a3b9-4f20-910c-4f63e88ce689/

Thanks! ❤️

websecnl commented 2 years ago

https://huntr.dev/bounties/c4b4b746-a3b9-4f20-910c-4f63e88ce689/

Thanks Jamie, but special thanks goes to the developers of Quickbox who have taken this report very seriously and implemented a remediation to the old config.php file very quickly.

CVEs List (2/6) , will update this once more CVE numbers get approved by MITRE:

Security Researchers: Joel Aviad Ossi, Jelle Ermerins, Alexander Bode

For every other security researcher reading this:

QuickBox now has a responsible disclosure mail: sec@quickbox.io Send your reports to there 👍

JMSDOnline commented 2 years ago

@omridon See the updated readme here. The update may additionally be done within QuickBox CE by clicking the "Run Updater" button.

@JamieSlome, as per what was brought to my attention, reproduced, tested and confirmed no longer an active RCE, we can report this as fixed. I had forgotten to push up the commit to finalize this as it was reported to me over the Holiday period and in the midst of heavy developments with the upcoming QuickBox Pro v3. So I did miss pushing up some commits. These should all be present and accounted for.

@websecnl, big credits to you guys for all that you do. It's a pleasure having you make my day a big ball of stress!!! 😂 ❤️

JamieSlome commented 2 years ago

@JMSDOnline - amazing, are you able to confirm what is the patch commit SHA that addresses this issue, so we can confirm it against the report?

https://huntr.dev/bounties/c4b4b746-a3b9-4f20-910c-4f63e88ce689/

Great work to all involved ❤️

websecnl commented 2 years ago

@JMSDOnline - amazing, are you able to confirm what is the patch commit SHA that addresses this issue, so we can confirm it against the report?

https://huntr.dev/bounties/c4b4b746-a3b9-4f20-910c-4f63e88ce689/

Great work to all involved ❤️

@JamieSlome https://github.com/QuickBox/QB/commit/61c42a30b4d50a4caa89b56384ac88f0bf337922

JamieSlome commented 2 years ago

@websecnl - thanks for this!

Confirmed against the report 🎉