With AI models becoming more and more powerful, it is assumed that bugs previously not found will be found and essentially be public knowledge.
For real security issues please direct message me Profile - michael - Moqui Forum or reach me directly via another method you know of. Any diffs that ARE NOT clean, fixes one problem with minimal lines, and aren’t easily human readable will be closed. Also, please provide a reproducible script, a link to the exact code problem, and an explanation of why it’s a security problem for one of the following conditions:
privilege escalation (low permissions to ADMIN usergroup)
authentication failures such as a bypass
sql injection outside of screens like sqlrunner and groovy runner (obviously)
We talked about this a bit on the community call last Friday. A few notes from some of my initial assessments might be helpful, but hopefully not so much that we don’t do a bunch of this over time.
Moqui itself has a relatively small attack surface, and that attack surface is fairly well guarded. The complexity of different ways of interacting with Moqui is largely collapsed to the HTTP screen interface, and there are also a few other Servlets that may be in place depending on configuration. There are some modules which add more endpoints, like the SubEtha embedded SMTP server, but those are not used as commonly.
One thing that might be a bit frightening is to look at what OFBiz is facing with these AI assisted security reviews. OFBiz is a very different animal, and has a massive attack surface without hierarchical isolation and authz, and with all sorts of tooling and interfaces that are archaic and probably should have been removed long ago. I wish them luck, feel for them, and have no intention of getting involved.
As an early step to work toward more of this, I added some security notes with boundary definitions to the Run & Deploy Guide, which is now conveniently in git:
The major thing that is now noted there is that Moqui Framework functionality is not a Web Application Firewall, it is different in nature and the wrong place for that job too. This has been discussed a bit, now is “officially” documented.