Critical Security Advisory: Authentication bypass in the Generic Interface when using HTTPBasicAuth SSO

Are you affected?

You are affected if both of the following apply to your installation:

1. Single sign-on is configured using the HTTPBasicAuth authentication module, and
2. The Generic Interface is enabled (i.e. one or more web services are configured and nph-genericinterface.pl is reachable).

If you do not use HTTPBasicAuth, or the Generic Interface is not in use, you are not affected by this specific issue.

Impact

Remote, unauthenticated execution of Generic Interface operations. Depending on the web services configured on the affected system, this can allow reading or modifying data exposed through those operations.

Remediation

Choose one of the following. Applying a patch level or the bugfix package is strongly preferred over the web server mitigation alone.

Option 1 — Update to the latest patch level (recommended)
Update your installation to the latest available patch level: 6.5.25 for Znuny LTS, 7.3.7 for Znuny.

Option 2 — Install the bugfix package
Install Znuny-Bugfix1645, available for Znuny LTS 6.0, Znuny LTS 6.5 and Znuny 7.3. This is the recommended route for Znuny LTS 6.0, which does not receive a new patch level. The package can be found in the Znuny Open Source Repository or downloaded manually:

• Znuny-Bugfix1645-6.0.1.opm for Znuny LTS 6.0.x
• Znuny-Bugfix1645-6.5.1.opm for Znuny LTS 6.5.x
• Znuny-Bugfix1645-7.3.1.opm for Znuny 7.3.x

Option 3 — Web server mitigation (interim only)
If you cannot update immediately, strip any client-supplied Remote-User header on the Generic Interface path in your Apache configuration:

<LocationMatch "^/(otrs|znuny)/nph-genericinterface.pl">
    RequestHeader unset Remote-User
</LocationMatch>

Place a file with this content in /etc/httpd/conf.d/ on RHEL-based systems, or in /etc/apache2/conf-available and enable it with a2enconf on Debian-based systems. Don't forget to reload the web server.

Option 3 is a mitigation, not a fix. Apply Option 1 or Option 2 as soon as possible.

Recommended action

We strongly recommend that all affected operators apply Option 1 or Option 2 without delay and use Option 3 as an interim measure only when an immediate update is not possible.

Credits

We would like to thank Mokrane ABDELMALEK for responsibly reporting this vulnerability. The issue, which had been there for over ten years, was identified as part of the Ghent University VDP program vdp.ugent.be.

Questions and support

If you need help assessing or remediating your installation, you can contact us.