PT-2021-23205 · Hangfire · Hangfire
Odinserj
·
Published
2021-11-02
·
Updated
2021-11-04
·
CVE-2021-41238
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Hangfire versions 1.7.25
Description
Hangfire is an open source system to perform background job processing in .NET or .NET Core applications. The Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. However, due to recent changes, in version 1.7.25, no authorization filters are used by default, allowing remote requests to succeed. If the
UseHangfireDashboard method is used with the default DashboardOptions.Authorization property value, the installation is impacted. The issue can be mitigated by upgrading to the newest version or by using the LocalRequestsOnlyAuthorizationFilter explicitly when configuring the Dashboard UI.Recommendations
For Hangfire version 1.7.25, upgrade to version 1.7.26 to mitigate the issue.
As a temporary workaround for version 1.7.25, consider using the
LocalRequestsOnlyAuthorizationFilter explicitly when configuring the Dashboard UI, for example:csharp
app.UseHangfireDashboard("/hangfire", new DashboardOptions
{
Authorization = new []{ new LocalRequestsOnlyAuthorizationFilter(); }
});Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hangfire