SubleXBle/Fail2Ban-Report 0.5.2

Beta 5.2

on GitHub

Summary

This PR addresses multiple critical security vulnerabilities discovered in the multi-server synchronization and authentication subsystems introduced in v0.5.0. It cumulative-patches all issues reported by the security community, transitioning the project into a hardened, production-ready state for v0.5.2.

Changes Included

1. Centralized Authentication Gate (auth.php & header.php)

   • Fixed a critical authentication bypass where unauthenticated sessions were incorrectly granted a default viewer role.
   • Enforced strict session-level barrier ($_SESSION['username']) on all data and read plane endpoints (get-blocklist.php, get-json.php, etc.).

2. Secure Password Hashing (manage_users.sh & manage-clients.sh)

   • Mitigated a shell command injection vulnerability where passwords containing specific characters (like apostrophes) were executed as raw PHP program text.
   • Switched to passing credentials safely via isolated environment variables (getenv()) combined with strict alphanumeric username validation.

3. Process Table Hardening (syncback.sh & fail2ban_log2json.sh)

   • Fixed a credentials leak where sync keys (CLIENT_PASS) were exposed to the host's public process listing (argv) via curl -F.
   • Refactored requests to dynamically pass credentials using temporary, restricted configuration files (chmod 600).

4. API Endpoint Security (action_report-ip.php)

   • Enforced mandatory admin privilege validation on the reporting plane.
   • Integrated IP structure enforcement (FILTER_VALIDATE_IP) and hardcoded whitelisting for external service modules (AbuseIPDB / IPinfo).

Verification & Severity

All fixes have been validated against the provided Proof-of-Concept parameters. The read plane, client credential storage, and shell interface are now fully isolated and hardened. Separate CVE records have been requested to credit the contributing researchers.

Target Release: v0.5.2