nerves-hub / nerves_hub_web

Manage firmware updates for Nerves devices
https://nerves-hub.org/
Apache License 2.0
184 stars 69 forks source link

device console: authorization during channel join #1357

Closed joshk closed 3 months ago

joshk commented 3 months ago

A security issue was found with the UserConsoleChannel where an authorization check was missing during the channel join function.

Without this check, any authenticated user can connect to any connected device that has the remote console channel enabled.