Fix inconsistent host ownership check leading to unauthorized access via CAID mismatch

Vulnerability Overview This vulnerability involves unifying the host ownership anchor on to align with the JSON API. Specifically, , , and previously relied on (the host's network CA) to verify host ownership. Other host handlers (such as , , and ) relied on (the host's own CA). Impact Scope Affected Versions: All versions performing host ownership checks using and . Potential Risk: Due to inconsistencies between and , host ownership checks may become vulnerable, thereby compromising system security. Remediation 1. Unify Host Ownership Anchor: - Unify the host ownership verification logic in , , and to use . - Ensure becomes the sole host ownership anchor via the helper function. 2. Code Changes: - In : - Replace the manual and network ownership check block in with . - Retain the load to display the CIDR. - In , parse and replace the ownership check block with . - In , use as the first operation, followed by the mobile bundle operation. - In , add three regression tests (403 Forbidden for non-owners on , plus assertions for owner-positive cases and store state). 3. Side Effects (Double Hardening): - now checks ownership before gating the mobile bundle; non-owners will receive a 403 instead of a 400. - Potential operator skip is closed; the previous guard allowed unauthorized requests to bypass ownership checks. redirects operators to the login page. 4. Testing: - Run and to ensure existing tests and paths remain unaffected. - Run and to ensure code quality and baseline consistency. Code Block Summary This fix eliminates inconsistencies between and by unifying the host ownership anchor, thereby enhancing system security and stability.

Goal Reached Thanks to every supporter — we hit 100%!

Fix inconsistent host ownership check leading to unauthorized access via CAID mismatch

More from this source