Added option to check HTTP origin.
Ylian Saint-Hilaire committed
Feb 17, 2024 at 11:22 UTC
f2e43cc6da9f5447dbff0948e6c6024c8a315af3
4 files changed
+29
-1
meshcentral-config-schema.json
+9
@@ -1134,6 +1134,15 @@
1134
"type": "string"
1135
}
1136
},
1137
+ "allowedOrigin": {
1138
+ "type": [ "array", "boolean" ],
1139
+ "default": false,
1140
+ "uniqueItems": true,
1141
+ "description": "A list of allowed hostnames for HTTP request origin header. If false, a default list is created, if true, all hostnames are allowed.",
1142
+ "items": {
1143
+ "type": "string"
1144
+ }
1145
+ },
1146
"welcomeText": {
1147
"type": "string",
1148
"description": "Text that will be shown on the login screen."
meshcentral.js
+1
@@ -1312,6 +1312,7 @@ function CreateMeshCentralServer(config, args) {
1312
if (typeof obj.config.domains[i].agentallowedip == 'string') { if (obj.config.domains[i].agentallowedip == '') { delete obj.config.domains[i].agentallowedip; } else { obj.config.domains[i].agentallowedip = obj.config.domains[i].agentallowedip.split(','); } }
1313
if (typeof obj.config.domains[i].agentblockedip == 'string') { if (obj.config.domains[i].agentblockedip == '') { delete obj.config.domains[i].agentblockedip; } else { obj.config.domains[i].agentblockedip = obj.config.domains[i].agentblockedip.split(','); } }
1314
if (typeof obj.config.domains[i].ignoreagenthashcheck == 'string') { if (obj.config.domains[i].ignoreagenthashcheck == '') { delete obj.config.domains[i].ignoreagenthashcheck; } else { obj.config.domains[i].ignoreagenthashcheck = obj.config.domains[i].ignoreagenthashcheck.split(','); } }
1315
+ if (typeof obj.config.domains[i].allowedorigin == 'string') { if (obj.config.domains[i].allowedorigin == '') { delete obj.config.domains[i].allowedorigin; } else { obj.config.domains[i].allowedorigin = obj.config.domains[i].allowedorigin.split(','); } }
1316
if ((obj.config.domains[i].passwordrequirements != null) && (typeof obj.config.domains[i].passwordrequirements == 'object')) {
1317
if (typeof obj.config.domains[i].passwordrequirements.skip2factor == 'string') {
1318
obj.config.domains[i].passwordrequirements.skip2factor = obj.config.domains[i].passwordrequirements.skip2factor.split(',');
views/default.handlebars
+2
-1
@@ -1,4 +1,4 @@
1
-<!DOCTYPE html>
1
+<!DOCTYPE html>
2
<html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
3
<head>
4
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -2133,6 +2133,7 @@
2133
QV('verifyEmailId2', false);
2134
QV('logoutControl', false);
2135
if (errorCode == 'noauth') { QH('p0span', "Unable to perform authentication"); return; }
2136
+ if (errorCode == 'invalidorigin') { QH('p0span', "Invalid origin in HTTP request"); return; }
2137
if (prevState == 2) { if (autoReconnect) { setTimeout(serverPoll, 5000); } } else { QH('p0span', "Unable to connect web socket"); }
2138
if (authCookieRenewTimer != null) { clearInterval(authCookieRenewTimer); authCookieRenewTimer = null; }
2139
} else if (state == 2) {
webserver.js
+17
@@ -5734,6 +5734,18 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5734
return obj.certificates.CommonName;
5735
}
5736
5737
+ // Return true if this is an allowed HTTP request origin hostname.
5738
+ obj.CheckWebServerOriginName = function (domain, req) {
5739
+ if (domain.allowedorigin === true) return true; // Ignore origin
5740
+ if (typeof req.headers.origin != 'string') return true; // No origin in the header, this is a desktop app
5741
+ const originUrl = require('url').parse(req.headers.origin, true);
5742
+ if (typeof originUrl.hostname != 'string') return false; // Origin hostname is not valid
5743
+ if (Array.isArray(domain.allowedorigin)) return (domain.allowedorigin.indexOf(originUrl.hostname) >= 0); // Check if this is an allowed origin from an explicit list
5744
+ if (obj.isTrustedCert(domain) === false) return true; // This server does not have a trusted certificate.
5745
+ if (domain.dns != null) return (domain.dns == originUrl.hostname); // Match the domain DNS
5746
+ return (obj.certificates.CommonName == originUrl.hostname); // Match the default server name
5747
+ }
5748
+
5749
// Create a OSX mesh agent installer
5750
obj.handleMeshOsxAgentRequest = function (req, res) {
5751
const domain = getDomain(req, res);
@@ -6434,6 +6446,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6446
obj.app.ws(url + 'control.ashx', function (ws, req) {
6447
getWebsocketArgs(ws, req, function (ws, req) {
6448
const domain = getDomain(req);
6449
+ if (obj.CheckWebServerOriginName(domain, req) == false) {
6450
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'invalidorigin', msg: 'invalidorigin' })); } catch (ex) { }
6451
+ try { ws.close(); } catch (ex) { }
6452
+ return;
6453
+ }
6454
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { ws.close(); return; } // Check 3FA URL key
6455
PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie, authData) {
6456
if (user == null) { // User is not authenticated, perform inner server authentication