jamf / NetSUS

NetBoot and Software Update Server
https://jamfnation.jamfsoftware.com/viewProduct.html?id=180
304 stars 69 forks source link

Stop code execution if user is not authenticated #154

Closed sunny0day closed 3 years ago

sunny0day commented 3 years ago

Without an exit statement after the 302 response header is set, all code after including this file, will be executed.

This is a major security vulnerability, because one would be able to, for example:

as an unauthenticated user.