Bug 58280 - meta.json leaks FQDN and serveraddress
Summary: meta.json leaks FQDN and serveraddress
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: UMC (Generic)
Version: UCS 5.0
Hardware: Other Linux
: P5 major
Target Milestone: UCS 5.2-1-errata
Assignee: Iván.Delgado
QA Contact: Christian Castens
URL: https://git.knut.univention.de/univen...
Keywords:
Depends on: 54257
Blocks:
  Show dependency tree / graph
 
Reported: 2025-05-19 12:09 CEST by Iván.Delgado
Modified: 2025-05-28 13:40 CEST (History)
8 users (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Customer ID:
Max CVSS v3 score: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Iván.Delgado univentionstaff 2025-05-19 12:09:29 CEST 
curl https://demo.univention.de/univention/meta.json | python -m json.tool | less

The meta.json for unauthenticated users leaks information about the domain, e.g fqdn and serveraddress


+++ This bug was initially created as a clone of Bug #54257 +++
Comment 2 Iván.Delgado univentionstaff 2025-05-23 14:07:37 CEST 
(EXPERIMENTAL) Potentially sensitive data in the `meta.json` file can now be hidden using the EXPERIMENTAL UCR variable `umc/web/meta/hide-sensible-data`.

Additionally, the server's address is no longer included in the `meta.json` file by default. It is now only visible during system setup.

Successful build
Package: univention-portal
Version: 6.1.2
Branch: 5.2-0
Scope: errata5.2-1

Successful build
Package: univention-management-console
Version: 14.1.4
Branch: 5.2-0
Scope: errata5.2-1
Comment 4 Christian Castens univentionstaff 2025-05-23 14:15:48 CEST 
QA:
 OK: advisories
 OK: code review
 OK: server address hidden by default
 OK: `umc/web/meta/hide-sensitive-data` hides fqdn if set to true, deactivated by default