Securing Activiti Modeler

[balsarori]

Currently, Activiti Modeler can be accessed (and models can be modified) without authentication by directly accessing the Modeler, for example:

http://localhost:8080/activiti-explorer2/service/editor?id=50

Of course, there are different options for administrators to handle this but I think that it should not be left unsecured by default.

Both Activiti Explorer (Authentication via custom Vaadin Login Form) and Activiti Rest API (Basic HTTP Authentication) are secured by default.

Since Activiti Modeler is a part of Activiti Explorer, I suggest that access to Activiti Modeler should only be allowed if the user has already logged in to Activiti Explorer.

What do you guys think?

[jbarrez]

Yes, I think that is indeed needed (and we discussed it too already, agreeing we need to add it asap).

[balsarori]

I'm not sure whats the best way to do this. Anyway, here is what I think can be one option

https://github.com/balsarori/Activiti/commit/4a42468048ac5cd2ec139f519348b62bbab804e2

In this code any call to '/service' will not be allowed unless user was already authenticated (either by Vaadin login form or by Servlet Container). When a user logins to Explorer an attribute is saved in the session (the user id, could be anything else). ExplorerFilter checks for this attribute and will not allow access to '/service' unless this attribute was set or user was authenticated by Servlet Container.

[jbarrez]

Yes, that makes sense. We'll discuss it shortly, and I have put your link on my notes. Thanks!

[mathewjohnston]

Can you provide any update? This appears to still be an issue, as of 5.16. In the meantime, is there any way to completely disable modeler (without deploying an SSL decrypting WAF, that is). Unfortunately, I can't deploy Activiti into production with such a severe vulnerability.

EDIT: I notice that JIRA ticket ACT-1970 tracks this, filed at the end of March 2014, but is marked as minor priority. This vulnerability, unless mitigated, would prevent Activiti Explorer's use in any enterprise, so might justify a higher priority.

Thanks!

[fionn]

Any updates on this issue?
The above fix worked.

[jbarrez]

Ideally that fix is added to the code. Not sure if it covers all use cases.
A pull request would most certainly be appreciated, if you say you've successfully verified it!

[balsarori]

I've created a pull request that secures access to /service, process definitions and models should now be accessible to authenticated users only.

https://github.com/Activiti/Activiti/pull/533

[b_schnarr]

balsarori, thanks. Imho, this is a very important feature and should be merged immediately.