EducationSoftwareStrategy.com
StrategyCommunity

Knowledge Base

Product

Community

Knowledge Base

TopicsBrowse ArticlesDeveloper Zone

Product

Download SoftwareProduct DocumentationSecurity Hub

Education

Tutorial VideosSolution GalleryEducation courses

Community

GuidelinesGrandmastersEvents
x_social-icon_white.svglinkedin_social-icon_white.svg
Strategy logoCommunity

© Strategy Inc. All Rights Reserved.

LegalTerms of UsePrivacy Policy
  1. Home
  2. Topics

KB485024: Non-secure connections present security vulnerability


Xiaoqian Zhu

Software Engineer, Principal • MicroStrategy


This article addresses why a security vulnerability error is returned when republishing a cube or importing data from a URL. This article also provides workarounds to avoid this behavior.

Description 


When republishing a cube or importing data from a URL (as described below), the following error message may be returned:
Non-secure connections i.e. HTTP/FTP presents security vulnerability. Please refer to [KB485024] for more details. 
 

ka04W000001Ev0tQAC_0EM4W00000289ad.jpeg

You may encounter this error in the following scenarios:

  • You republish a cube or import data from a URL with Windows, Basic, Shared Kerberos, or Integrated authentication in HTTP or FTP protocol.
  • You import from a URL with Windows or Basic authentication in FTP protocol, where the FTP server is without an SSL certificate. 
  • You republish a cube with Windows or Basic authentication in HTTP or FTP (server without SSL certificate). 


 

Why is this happening?


Prior to Strategy 2021 Update 2, when the data source is selected as a URL, you are allowed to select Windows authentication, Basic authentication, Shared Kerberos authentication, or Integrated authentication, as well as HTTP or FTP as the protocol. This can send the window credentials via the insecure HTTP protocol, versus a more secure HTTPS protocol. 
In Strategy 2021 Update 2, the following changes have been made:

  • HTTP protocol is disabled for Windows, Basic, Shared Kerberos, and Integrated authentication methods. For HTTP protocol, only Anonymous authentication is supported.
  • For FTP protocol, if the FTP server has an SSL certificate, URLs with Windows or Basic authentication can be imported. Otherwise, import fails. 


 

Workaround 

  • Use HTTPs protocol for Windows, Basic, Shared Kerberos, and Integrated authentication methods. 
  • For older cube versions with Windows or Basic authentication, edit the cube to refresh the table with HTTPS protocol. 
  • Add SSL certificate for the FTP server. 
ka04W000001Ev0tQAC_0EM4W00000289bW.jpeg

 


Comment

0 comments

Details

Knowledge Article

Published:

May 11, 2021

Last Updated:

June 30, 2021