search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.35k stars 159 forks source link

force https on url being built for post #217

Closed tiagoasousa closed 1 year ago

tiagoasousa commented 1 year ago

Describe the bug first install, vectr is behind a ALB (not sure if it impacts) for some reason the URI that gets built for the admin callback is built with http instead of https changing this at browser inspector level cause login to work

To Reproduce Steps to reproduce the behavior:

  1. Go to 'Login Page'
  2. Insert first login credentials
  3. See error

Expected behavior Login is possible

Screenshots If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

Form in question: view-source:https://vectr.xyz.com/auth/login Line22:

<form id="authform" class="loginform" method="POST" action="[http://vectr.xyz.com/auth/login/callback/faaf232d-fe9a-4b11-8fc8-fed3d2931a76](view-source:http://vectr.xyz.com/auth/login/callback/faaf232d-fe9a-4b11-8fc8-fed3d2931a76)"><input type="hidden" name="_csrf" value="0e00ca29-5b11-4c79-ac0c-06d28eb1496a" />

SRAPSpencer commented 1 year ago

We've been unable to recreate this internally. This sounds like an issue with your ALB rewriting headers. I would advise you check it's configuration.

tiagoasousa commented 1 year ago

this is default aws lb, not sure it´s rewriting anything. is it possible to know what header your application is expecting to have to construct the uri with https instead of http?