HAP v10.2 Security Issue?

[TheAG]

Hi Everyone,

 

We have been using HAP for over a year now and are really happy with it. I've just upgraded to v10.2 and after a bit of playing around I have noticed that if you change the login url from /login.aspx?ReturnUrl=%2f to /setup.aspx I can access the backend with no authentication challenge!

 

Has anyone seen the same thing or something similar?

 

Thanks

 

Quick Edit: without entering any passwords I have successfully added an AD group to HAP and changed around the front page icons!!

Edited August 6, 2014 by TheAG

[nickbro]

Save the config, it'll tell you what you do to lock it down

[TheAG]

Hi Nick,

 

I went through that but it would't work. I ended up creating a new file called setup.aspx and copying the contents over and deleting the original one. It seemed to work ok after that.

I'm guessing it might have been an issue when extracting the files as I had a problem with incorrect permissions getting applied to the HAP folder.

 

Everything is nice and secure now.

 

Thanks

[nickbro]

The info at the top of the page will lock the page down so no one can access it without a domain admin account.

[TheAG]

That was the issue, it wasn't locking the page and left it open for anyone to access the backend. Once I recreated the setup.aspx it worked.

I have checked the rest of the site and it seems fine too.

 

As I said, there were some odd permissions that got applied when copying over the HAP directory, even though I reset them I wonder if that might have caused the problem. I have had a quick play with HAP and IIS7.5 this afternoon and I can't replicate the error.

[nickbro]

Ok, good to know, odd issue.