francesco146 / be-passportease

BackEnd of a computer system to manage the reservation service for passport issuance for a Police Headquarters, which has multiple locations in the territory.

Hi 👋! My name is Francesco and I'm a undergraduate here in UniVR, from Italy

be-passportease's Issues

[Security] Improper Certificate Validation

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

org.springframework.boot:[email protected]

Affected versions of this package are vulnerable to Improper Certificate Validation. Certificate hostname validation is disabled by default in Netty 4.1.x which makes it potentially susceptible to Man-in-the-Middle attacks.

---

Additional context

• More information on the Snyk Report
• This vulnerability is only applicable when certificate hostname validation is disabled.

[Security] Information Exposure from GraphQL Dependency

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

com.graphql-java-kickstart:[email protected]

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

---

Additional context

• More information on the Snyk Report
• As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

[🚀 Feature] Dockerize the BackEnd

Dockerize the full stack application using Docker Compose V2.

Currently these parts runs on a container:

• Postgres
• Redis

These parts need to be modified:

• Spring Boot

[Security] Allocation of Resources Without Limits or Throttling

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

redis.clients:[email protected] › org.json:json@20230618

Description

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can cause indefinite amounts of memory to be used by inputting a string of modest size. This can lead to a Denial of Service.

Additional context

• More information on the Snyk Report
• Version 20231013 isn't vulnerable

[Security] Access Restriction Bypass

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

org.springframework.boot:[email protected]

The package in question is vulnerable to Access Restriction Bypass. If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.

The vulnerability is limited to the ROOT (default) web application.

---

Additional context

• More information on the Snyk Report
• It's fixed in org.apache.tomcat.embed:[email protected], @9.0.80, @10.1.13, @11.0.0-M11, but spring boot doesn't use any of these versions