fix: use POST instead of GET when validating credentials #90
Conversation
|
@kimmknight would you mind publishing a security advisory for this? I don't have permission. Title: Credentials are exposed in IIS logs DescriptionImpactCredentials are exposed in the IIS logs at PatchesThe problem has been patched in RAWeb release v2025.07.10.0. WorkaroundsDisable IIS logs. ReferencesReported by @akarl10 in issue #89. Ecosystem: GitHub Release Package name: kimmknight/raweb Affected versions: >= 2025.06.16.1, < v2025.07.10 Patched versions: >= 2025.07.10.0 Severity (CVSS v3) vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Common weakness enumerator: CWE-532 Credits: @akarl10 - Reporter, @jackbuehner - Remediation developer |
|
Absolutely, and thank you! Just at the zoo with my family, will get on to it this evening.. |
This change switches the credential validation request from GET to POST. When it was a GET request, the cerednetials were encoded in the URL. This ensures that credentials are not exposed in the IIS logs, which would include the credentials from the URL.
Tested with:
Test release: https://github.com/jackbuehner/raweb/releases/tag/v2025.07.10.0
Resolves #89