Page Comparison

This document was created for review by the Synapse engineering team to respond to

...

The domain for the repository services (repo-<stack>.prod.sagebase.org) were also specified in the report, but the services are not vulnerable to the same attack, and specific findings were not provided. There is a related misconfiguration that does not expose us to any vulnerability, but we should address it to reduce the risk of vulnerabilities introduced by future changes.

...

By default, browsers restrict JavaScript code from accessing the response of an HTTP request to a different origin than an origin different from that of the open window or frame. For certain types of requests, browsers send a “preflight” request to determine if the request would be allowed before it is sent. The server can set values in certain headers to loosen these restrictions. This document will focus only on the headers referenced in the penetration test and issue for the sake of brevity.

...

parse @message '* - * [*] "* * *" * * "*" "*"' as host, identity, dateTimeString, httpVerb, url, protocol, statusCode, bytes, referer, useragent
| parse referer '*://*/' as protocol2, domain
| fields concat(protocol2, "://", domain) as origin
| stats count() as count by origin
| sort count desc

...

SELECT ORIGIN, COUNT(*) AS NUMBER_OF_RECORDS
FROM ACCESS_RECORD
WHERE TIMESTAMP BETWEEN unix_timestamp(curdate())*1000 - (30*24*60*60*1000) AND unix_timestamp(curdate())*1000
GROUP BY ORIGIN;

...