Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSL configuration insecure exception #1145

Closed
FranciscoCunha97 opened this issue Jan 23, 2023 · 3 comments
Closed

SSL configuration insecure exception #1145

FranciscoCunha97 opened this issue Jan 23, 2023 · 3 comments

Comments

@FranciscoCunha97
Copy link

According to the code presented in the file UtilsHelper.php, we can see if the host of the URL request is the same one as the PHP server host, the SSL verification, which by default is turned on, is disabled in this scenario.

This leaves this communication open to Man-in-the-middle attacks from inside the PHP Host.

The reccomendations is part of a privately disclosed report, with the id MOV - 001

@edhelas
Copy link
Member

edhelas commented Jan 27, 2023

I am wondering if this is really a security issue.
This would require to setup a SSL layer for a local-to-local request. It is also not possible to separate the client from the server for that specific case, so the requests made here will never pass on a network afaik.

@FranciscoCunha97
Copy link
Author

The purpose of this change is to promote zero-trust environment inside Movim system

@edhelas
Copy link
Member

edhelas commented Jun 20, 2024

Closing the issue as this is not actually something I'm planning, and willing, to change/fix

@edhelas edhelas closed this as completed Jun 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants