215d2ec108
Previously the `RememberMe` object (containing the AES-encrypted password and the decryption key) was serialized directly into the PHP session while waiting for the user to complete the 2FA challenge. Because PHP sessions are written to disk in plaintext, this exposed the key and ciphertext in the same place, sufficient to recover the user's password. Fix by splitting the secret across the session and the database, mirroring the design of the normal (non-2FA) remember-me flow: - Call `persist()` at login time so the AES key goes to the database immediately, never touching the session. - Store only the cookie value string (ciphertext + IV) in the session. The ciphertext is not exploitable without the key. - After a successful 2FA challenge, reconstruct the `RememberMe` object via a new `RememberMe::fromCookieData()` factory that does a DB lookup by IV and restores the canonical expiry from the database row. - Only then send the browser cookie, so the cookie never reaches the browser unless the second factor was verified. Canceled challenges remove the created DB row, while abandoned challenges leave an orphaned DB row which is cleaned up by the existing `RememberMe::removeExpired()` mechanism. `RememberMe::fromCookieData()` sets `$expiresAt` from the database row so the browser cookie issued after 2FA inherits the expiry stored at login time rather than receiving a fresh 30-day window computed at challenge-completion time. The renewal path in `AuthenticationController::loginAction()` is unaffected, because `renew()` constructs a new object via `fromCredentials()`. |
||
|---|---|---|
| .github | ||
| application | ||
| bin | ||
| doc | ||
| etc/bash_completion.d | ||
| library/Icinga | ||
| modules | ||
| public | ||
| schema | ||
| test | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| AUTHORS | ||
| CHANGELOG.md | ||
| composer.json | ||
| CONTRIBUTING.md | ||
| icingaweb2.ruleset.xml | ||
| LICENSE.md | ||
| phpcs.xml | ||
| phpstan-baseline.neon | ||
| phpstan.neon | ||
| phpunit.xml | ||
| README.md | ||
| RELEASE.md | ||
| SECURITY.md | ||
| VERSION | ||
Icinga Web 2
About
Icinga Web 2 is the next generation open source monitoring web interface, framework and command-line interface developed by the Icinga GmbH, supporting Icinga 2, Icinga DB Web and many more modules.
License
Icinga Web 2 and the Icinga Web 2 documentation are licensed under the terms of the GNU General Public License Version 3. You will find a copy of this license in LICENSE.md included in the source package.
Installation
For installing Icinga Web 2 please check the installation chapter in the documentation.
Documentation
The documentation is located in the doc/ directory and also available on icinga.com/docs.
Support
Check the project website for status updates. Join the community channels for questions or ask an Icinga partner for professional support.
Contributing
There are many ways to contribute to Icinga -- whether it be sending patches, testing, reporting bugs, or reviewing and updating the documentation. Every contribution is appreciated!
Please continue reading in the contributing chapter.
Security Issues
For reporting security issues please visit this page.