Security fixes
GHSA-hp22-gfvj-7m8r - MySQL proxy: authenticated memory exhaustion via unbounded max_packet_size - eee3915
Malicious target could cause an unbounded memory allocation
GHSA-cj29-mv44-r3g2 - is_localhost_host matches arbitrary 127.* DNS domains (post-SSO open redirect & control_plane_host bypass) and MFA+SSO drops SsoLoginState - d466f3c
Accessing a bound target domain matching the 127.* pattern would disable some security protections
GHSA-rccx-x2f2-qggp - The SSH target menu connects with a stale copy of the target, bypassing approval enabled while the menu is open
Target role changes made while a user already has the SSH target selection menu open would not affect their session.
GHSA-wv8f-pg5h-j86g - The Kubernetes proxy follows upstream redirects, fetching internal URLs from Warpgate's network position - acdf746
A malicious authenticated user with Kubernetes target access could perform arbitrary HTTP requests from Warpgate's network position.
GHSA-9cmw-ff3v-ggc9 - Single-target HTTP ticket sessions can attach to or terminate the owner's WebSSH/WebDesktop sessions and read SSO Kubernetes OIDC secrets - 2bebdf9
HTTP tickets were not restricted from controlling user's own WebSSH / Web desktop sessions and fetching Kubernetes OIDC secrets.
GHSA-2xj4-4766-4xwx - HTTP proxy forwards client-supplied X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers ahead of Warpgate's own headers - 90472d2
Client-supplied X-Forwarded-* headers were not stripped when forwarding to an HTTP target
GHSA-jgwh-2q6f-w7g6 - Login protection brute-force rate limiting bypass via Condition::any() in clear_failed_attempts - 21636e7
An authenticated user could bypass brute-force protection while bruteforcing another user's password.
Security hardening
- Secret references: mount and path segments are now validated by @mtthsbrd in #2815
- Ticket activation is now atomic, so concurrent requests can't use the same ticket more than once, by @mtthsbrd in #2818
- VNC: Tight compact-length bounds and the Apple DH public key range are now validated by @mtthsbrd in #2819
- Web UI: config warnings are no longer rendered as raw HTML, and target URLs and kubeconfig contents are now escaped, by @mtthsbrd in #2817
- Docker: trust roots updated for the eMudhra intermediate distrust by @SachinMaharana in #2775
Fixes
- fixed #2765 - web SSH opened two shell channels per session by @monsterlag in #2778
- SSH: the target list is reloaded when connecting from the interactive menu in 6dd8d23
- Kubernetes: watch streams are no longer buffered, and percent-encoded paths are decoded correctly in eea30c7
- OIDC: logout state is now stored earlier in the flow in 43acddf
- The Vault/OpenBao client now uses the OS trust store in a5773ca
Changes
- Accessibility: secondary text and field borders now meet WCAG AA contrast by @a1kudryavtsev in #2793 and #2794
- Database targets in the portal can now be reached with the keyboard by @a1kudryavtsev in #2801
- Users without any targets are now told who can grant them access by @a1kudryavtsev in #2804
- The profile page now explains empty credential sections by @a1kudryavtsev in #2803
- UI copy: page titles shortened to fit on phones, consistent title case, and one shared table of target kind labels by @a1kudryavtsev in #2799, #2798 and #2811
- Session IDs are now shortened in the log by @a1kudryavtsev in #2808
New Contributors
- @monsterlag made their first contribution in #2773
- @a1kudryavtsev made their first contribution in #2793
Full Changelog: v0.30.0...v0.30.1