Jian Qiu 2f0ce30f5c fix(webconsole): validate ssh target ip against accessible resources (#25487) ...

The ssh console endpoint accepted a raw ip address in the URL path
and dialed it directly with user provided credentials, so any
authenticated user could use the webconsole service as an internal
SSH proxy, port scanner and credential brute-forcer.

Resolve the ip against hosts (access_ip) and servers (ip_addr)
visible to the user's session and require it to match one of them,
rejecting all other addresses.

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-04 10:06:25 +08:00

..

display_info.go

…

doc.go

…

pty_session.go

…

remote_console_rdp.go

fix(webconsole): isolate RDP console sessions with unique ids (#25485)

2026-09-04 09:16:50 +08:00

remote_console.go

fix(region): vendor update (#25026)

2026-06-15 14:58:10 +08:00

resolve_sshinfo.go

fix(webconsole): validate ssh target ip against accessible resources (#25487)

2026-09-04 10:06:25 +08:00

session_key_test.go

fix(webconsole): generate session key with crypto/rand (#25486)

2026-09-04 09:17:43 +08:00

session_test.go

fix(webconsole): isolate RDP console sessions with unique ids (#25485)

2026-09-04 09:16:50 +08:00

session.go

fix(webconsole): generate session key with crypto/rand (#25486)

2026-09-04 09:17:43 +08:00

ssh_session.go

fix(webconsole): baremteasl ipmi sol instance_name hide password (#23535)

2025-10-16 00:02:33 +08:00