Security Advisories: Controller and RADIUS modules

[Federico Capoano]

I have published three security advisories affecting OpenWISP Controller and OpenWISP RADIUS:

1. [HIGH] Stored XSS in OpenWISP Controller: Malicious template names can execute JavaScript in administrator sessions.
   https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-4f2x-pxjx-h8m3

2. [MODERATE] Cross-organization user access in OpenWISP RADIUS: CSV batch imports can associate and delete users belonging to other organizations.
   https://github.com/openwisp/openwisp-radius/security/advisories/GHSA-83gw-w3g2-6658

3. [LOW] Cross-organization location access in OpenWISP Controller: Unauthorized access and modification of locations and potential exposure of device configuration keys.
   https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-39c4-xj33-j8j3

All three vulnerabilities have been fixed. We recommend upgrading to the latest patched releases:

• OpenWISP Controller: 1.3.1 or later
• OpenWISP RADIUS: 1.3.2 or later

We thank the security researchers involved and the GitHub Secure Open Source Fund for supporting this work.

Best regards

Federico Capoano

OpenWISP OÜ

Kotkapoja tn 2a-10, 10615, Harju maakond, Tallinn, Estonia

VAT: EE101989729

+372 59361689

openwisp.io

[f.ca...@openwisp.io]

We have released fixes for five security issues affecting OpenWISP Controller and OpenWISP RADIUS:

1. FreeRADIUS API IP restriction bypass: Attacker-controlled forwarded IP headers could bypass the allowed-host check.
https://github.com/openwisp/openwisp-radius/security/advisories/GHSA-hvmx-g7m2-vqx8

2. Cross-organization configuration access through the Controller admin: Users with a known resource UUID could access configuration data belonging to other organizations.
https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-2x7f-qxwh-m483

3. Cross-organization configuration downloads through the Controller REST API: Users with a known resource UUID could download configurations belonging to other organizations.
https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-5c5w-h9xc-3mq5

4. Shell injection in OpenWrt password changes: Unsanitized password fields could allow shell command execution on managed devices.
https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-rcf7-q946-fvpg

5. Cross-organization access to certificate revocation lists: Organization managers could download other organizations’ CRLs, including when configured as private. CA private keys were not exposed.
https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-9gh4-xw24-9xh5

All five vulnerabilities have been fixed. We recommend upgrading to the latest patched releases:

- OpenWISP Controller: 1.3.2 or later
- OpenWISP RADIUS: 1.3.3 or later

We thank the security researchers involved and the GitHub Secure Open Source Fund for supporting this work.

Best regards,
Federico Capoano