8000 Hosts can acquire valid password via password change · Issue #1920 · cyberark/conjur · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Hosts can acquire valid p 8000 assword via password change #1920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
3 tasks
john-odonnell opened this issue Nov 2, 2020 · 0 comments
Open
3 tasks

Hosts can acquire valid password via password change #1920

john-odonnell opened this issue Nov 2, 2020 · 0 comments
Labels
component/conjur kind/bug

Comments

@john-odonnell
Copy link
Contributor

Summary

Hosts, as non-human roles, are intended to only have an API key, and not a password. Setting a host's password is possible by making a request to the API endpoint to change a role's password using curl and a valid form of authentication. The password is then accepted as a valid means of authentication.

Steps to Reproduce

curl -X PUT -v --data My-Passw0rd\! --user 'host/host1:<api_key>' http://<conjur_host>/authn/dev/password

Expected Results

Request to change a host's password should be denied.

Actual Results (including error logs, if applicable)

A successful password change, and HTTP status 204 indicating such.

Reproducible

  • Always
  • Sometimes
  • Non-Reproducible

Version/Tag number

1.10.0

Environment setup

Found using the Conjur development environment detailed here.

Additional Information
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
component/conjur kind/bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@john-odonnell @foxefj-cyber
0