The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Before the issue, there is no blacklist for URL with file:// protocol. But now we add below blacklists for windows and Linux platform:
· Windows Blacklist: */Windows/*, */ProgramFiles/*, */Program Files(x86)/*, */Users/*
· Linux Blacklist: /etc/*, /bin/*, /var/*, /opt/*, /proc/*, /home/user/.bashrc, /usr/local/bin, /usr/bin
After m2021 update 7, we add registry key HKEY_LOCAL_MACHINE\SOFTWARE\MicroStrategy\DSS Suite\BlacklistForFile with default blacklists:
· Windows: (?i).*[/\\]+Windows[/\\]+.*|.*[/\\]+Program Files[/\\]+.*|.*[/\\]+Program Files\s*\(x86\)[/\\]+.*|.*[/\\]+Users[/\\]+.*i/
· Linux: /+etc/+.*|/+bin/+.*|/+opt/+.*|/+proc/+.*|/+home/+.*bashrc|/+usr/+local/+bin|/+usr/+bin
Only the value in the BlacklistForFile would be blocked to import from URL with file:// protocol. So Administrator could modify the value of BlacklistForFile to block the file path. If the administrator finds the BlacklistForFile, just modify the value; if not, please create a new registry key HKEY_LOCAL_MACHINE\SOFTWARE\MicroStrategy\DSS Suite\BlacklistForFile and fill blacklists value.
Note: We suggest restarting I-Server to take effect and avoid child process resue.
Scenario 1: If the user imports the URL with file:// protocol and the URL path contains with blacklist, it would report an error message.
Scenario 2: If the user republishes the dataset containing URL with file:// protocol and the URL path contains with blacklist, it would be failed. But the error message is not reported like below. The detailed error message could be found from DSSErrors.log.
For file:// protocol, there is no blacklist to forbid access to the system files currently. For example, if the user configures the whitelist for Data From URL as file://*, then the user could import the system files, such as file:///etc/password. we need to add the blacklist for the file protocol to deny the import of the sensitive files.
Do NOT access system files. Save the files into other folders which not include the blacklists.
