Starstruk Logo MarkStarstruk

v0.11.0

ruixenui/ruixen.comv0.11.0Aug 28, 2020by jordan-wright

AI Summary

A security-focused release addressing multiple critical vulnerabilities (SSRF, XSS, CSV Injection, Clickjacking).

Key Highlights

  • Fixed critical security vulnerabilities: SSRF, XSS, CSV Injection, and Clickjacking
  • Implemented password policy removing the default 'gophish' password
  • Added opt-in allowlist for internal hosts to prevent SSRF
  • Improved IMAP support for marking emails as reported

Breaking Changes

  • Removed default password 'gophish' (requires manual setup)
  • Requires opt-in allowlist for internal hosts via configuration variable

New Features

  • Password policy implementation
  • Robust IMAP support
  • Security fixes for SSRF, XSS, CSV Injection, and Clickjacking

Full Release Notes

### Gophish just got better.

We're excited to announce the release of Gophish v0.11.0. This release includes important security fixes, adds some minor features, and fixes some bugs.

### Security Fixes

This release addresses multiple security issues that were identified and reported by the community. As always, we encourage sending in security reports via our [security policy](https://github.com/gophish/gophish/blob/master/SECURITY.md), and are appreciative of all the work that went in to finding and reporting these vulnerabilities.

The following vulnerabilities were fixed in this latest release:

#### Server-side Request Forgery (SSRF)

Reported by: Marcus Nilsson of usd AG
Reported by: @dunderhay in #1908 

An authenticated user could use certain features of Gophish to make inbound connections to the local network. The most critical of these is via the Landing Page import feature, which could be used to make arbitrary upstream web requests.

Since importing local webpages, or otherwise making local network connections (e.g. for SMTP/IMAP servers, webhook URLs, etc.) is an expected use case for Gophish we've decided to implement an opt-in allowlist. By default, we block access only to known IP addresses commonly associated with cloud metadata services, but it is now possible to explicitly set the `allowed_internal_hosts` configuration variable in the `admin_server` section of config.json to a list of allowed internal addresses.

More information can be found [here](https://github.com/gophish/gophish/commit/e3352f481e94054ffe08494c9225d3878347b005).

#### Cross-Site Scripting (XSS)

Reported By: Marcus Nilsson of usd AG
Reported By: @dunderhay in #1901

Various cross-site scripting issues were identified and fixed. All issues required authenticated access and only affected either the user that created the objects, or an administrator using our "Impersonate" issue to impersonate the user that created the objects.

More information can be found in 4e9b94b and 19ef924d89f6e2459387d5645233f16fd07e01b3.

#### CSV Injection

Reported By: Marcus Nilsson of usd AG

Malicious data could be submitted during a campaign that, when exported as a CSV and opened in a spreadsheet viewer, is interpreted as a formula leading to command execution.

More information on CSV Injection can be found [here](https://owasp.org/www-community/attacks/CSV_Injection). More information about the fix can be found in b25f5ac5e468f6730e377f43c7995e18f8fccc2b.

#### Clickjacking

Reported By: Marcus Nilsson of usd AG

An attacker could create an iframe which tricks an authenticated administrator into unexpectedly clicking the "Reset" button in the settings page, causing their API key to be reset, potentially causing a denial of service condition.

More information about the fix can be found in 6df62e85fd60f0931d3c8bfdb13b436a961bc9b6.

### Adding a Password Policy

This release adds a basic password policy for administrators, and removes the default password "gophish". Instead, an initial password is randomly generated and printed in the terminal when Gophish is launched for the first time.

It is possible to override the initial password and API key with environment variables if needed.

### More Robust IMAP Support

This release adds the ability to mark emails as reported that were sent as an attachment. Additionally, it changes the underlying IMAP library to be more robust, eliminating some possible bugs.

Credit to @glennzw for the changes!

### Changelog

You can find the full changelog for this release [here.](https://github.com/gophish/gophish/compare/v0.10.1...v0.11.0)

### How to Upgrade

To upgrade, download the release for your platform, extract into a folder, and copy (**remember to copy, not move so that you have a backup**) your existing gophish.db file into the new directory. Then, run the new Gophish binary and you'll be good to go!

Now, one more thing:

### We want to hear from you! 

Have questions, comments, or feature ideas about Gophish? Let us know by [filing an issue](https://github.com/gophish/gophish/issues/new).

### Enjoy

| SHA256 Hash | Filename |
|-----|-----|
|beb32e243e888f21849d3ee09a979a33cd1da7a7cd79438c8f56fce1a2d9d44c|gophish-v0.11.0-linux-32bit.zip|
|f33ac7695850132c04d190f83ef54732421a8d4578be1475d3a819fe6173c462|gophish-v0.11.0-linux-64bit.zip|
|f1af96033c946ed2fe757b9b3a7aefc63ec3548f0ab21f01c44d70a58410ffbe|gophish-v0.11.0-osx-64bit.zip|
|f5083bc084715319a4e671bc58dc28f66828fec78a43bd41456373fcc024703c|gophish-v0.11.0-windows-64bit.zip|