Repository navigation
Don't confirm CouchDB CRITICAL from a generic JSON array - #47
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Port 5984 is in the default scan set. GET /_all_dbs returning HTTP 200 with a body that merely started with '[' (invalid JSON, a REST list, or an empty array from an unrelated API) pinned unauthenticated admin access. Fusion treats source=probe findings as un-droppable. Require a JSON array of database-name strings plus CouchDB identity (Server header, system db names, or the Welcome document). Co-authored-by: dmitryflynn <dmitryflynn@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port 5984 is in the default scan set, so
check_couchdb_noauthalways runs. GET/_all_dbsreturning HTTP 200 with a body that merely started with[confirmed CRITICAL unauthenticated admin access — including invalid JSON ([object Object]), a REST API list, or[]from an unrelated JSON service. Fusion treatssource=probe+ high reliability as un-droppable, so the false CRITICAL could not be discarded.Trigger: scan a host with anything on 5984 that returns a JSON array (docker-mapped API, catch-all that returns
[], JS that starts with[).Fix: require a JSON array of database-name strings plus CouchDB identity (Server header,
_users/_replicator/_global_changes, or the Welcome document).Tests:
test_probers.pycovers the false-positive bodies and still confirms real CouchDB (_users, empty array withServer: CouchDB, Welcome-identified named dbs). Fullpython3 -m pytest test_*.py -q: 1755 passed, 5 skipped.