Web services accessible without authentication

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 6.0.6 GA, 6.0.12 EE, 6.1.0 CE GA1, 6.1.10 EE GA1
• Fix Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2, 6.0.X EE, --Sprint 11/12, 6.2.0 CE M2
• Component/s: API, API > Portal Service, Security
• Labels: None
• Similar Issues: Show 5 results ; ;

  LPS-26935	All JSON web services are accessible without authentication.
  LPS-29930	Create authentication endpoints for web services authentication process
  LPS-27888	Split web service authentication into verification process and authentication process
  LPS-30202	JSON Web Services authentication issues and inconsistency
  LPS-26803	Introduce a layer for web service access security

By carefully constructing a HTTP POST request, an attacker can execute any of the portal's web services. This vulnerability allows the attacker to circumvent both the permission system and the protection provided by the SecureFilter's portal properties:

xxx.servlet.hosts.allowed
xxx.servlet.https.required

[Samuel Kong]

The code for this ticket was committed under LPS-27046, LPS-27101, LPS-27102.