Skip to Content
Menu
This question has been flagged
1 Reply
3063 Views

Hello,

We are are trying to make a pci compliant website with odoo community 11, in particular we are getting a vulnerability issue, with a Saint scan software when it tries to execute index.jsp (wich of course doesn't exists in Odoo), Odoo webserver response with Javascript code (here a fragment):


Sent: GET /web/content/1715-456fe75/index.JSP

_.isFunction(value)?value.call(object):value;};var idCounter=0;_.uniqueId=function(prefix){var
id=++idCounter+'';return prefix?prefix+id:id;};_.templateSettings={evaluate:/<%([\s\S]+?)%>/g,interpolate:
/<%=([\s\S]+?)%>/g,escape:/<%-([\s\S]+?)%>/g};var noMatch=/(.)^/;var escapes={"'":"'",'\\':'\\','

Is there any way to avoid this?

Regards,

Avatar
Discard
Best Answer

odoo minify all the js and css content and stored in a database and generate unique/hash URL starts with /web/content/XXX/assets and server it WebClient as static assets. sadly it didn't check file extraction resource request.

even GET /web/content/1715-456fe75/index.sucks  # it also accessible :)

so here you have two options
1) configure Nginx and block all the request url start with /web/content and end with an unknown extension (allow only .js, .css. and image extension)
2) https://github.com/odoo/odoo/blob/11.0/odoo/addons/base/ir/ir_http.py#L325 
here you get filename check it and return 404 for an unknown extension.

Avatar
Discard
Related Posts Replies Views Activity
2
Oct 19
2644
2
Aug 19
3340
1
Mar 23
11843
0
Dec 22
2362
5
Dec 24
7003