s.gruessing/IT-Nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: WS-Rollenprüfung, JWT-Cookie statt localStorage, XSS/SSRF-Fixes, RDP-Consent-Secret
Some checks failed
IT Nexus Deploy / Build Frontend (push) Has been cancelled
Details
IT Nexus Deploy / Deploy to Production (push) Has been cancelled
Details

Browse Source 
- WebSocket Shell/RDP: Rollenprüfung statt nur JWT-Gültigkeit (war: jeder eingeloggte User konnte fremde Agents per Shell/RDP übernehmen)
- JWT_SECRET: Server bricht ab statt mit unsicherem Default weiterzulaufen
- Auth: Token läuft jetzt über httpOnly-Cookie statt localStorage (XSS-Schutz gegen Session-Diebstahl)
- WS-Auth: Token nicht mehr als URL-Query-Param (landete in nginx-Logs), sondern als erste Message bzw. automatisch via Cookie
- Frontend: toter Rollen-Check (isSuperAdmin/isAdmin ohne Funktionsaufruf) in AgentDetailPage gefixt
- XSS: DOMPurify-Sanitizing für alle marked.parse()-Renderstellen (KI-Antworten, Kommentare, Knowledge Base)
- E-Mail: HTML-Escaping für alle ticket-gesteuerten Felder (auch über öffentliche Ticket-Route erreichbar)
- SSRF-Schutz beim Knowledge-Base-URL-Import (blockt private/Loopback-Adressen)
- TV-Dashboard: Shared-Key statt komplett offenem Endpoint
- Striktes Rate-Limit auf /login, must_change_password serverseitig erzwungen
- Agent (C#) v2.7.0: RDP-Consent/Disconnect/Capture verlangen jetzt ein Pro-Session-Secret (war: jeder lokale Prozess konnte Consent vortäuschen), DataDir-ACL für agent.log/status.json
- FIDO-PINs AES-256-GCM-verschlüsselt statt Klartext, Retention-Job für alte patch_commands/audit_log

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Simon Grüssing
2026-06-26 13:27:17 +02:00
parent 3ea28def4c
commit 81b1c326fc
47 changed files with 706 additions and 235 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
agent-cs/AgentWorker.cs
View File

@@ -6,7 +6,7 @@ namespace ITNexusAgent;
public class AgentWorker
{
private const string Version = "2.6.0";
private const string Version = "2.7.0";
private const string DataDir = @"C:\ProgramData\IT Nexus Agent";
private const string ConfigPath = @"C:\ProgramData\IT Nexus Agent\config.json";
private const string StatusPath = @"C:\ProgramData\IT Nexus Agent\status.json";
@@ -24,6 +24,7 @@ public class AgentWorker
{
_exePath = System.Diagnostics.Process.GetCurrentProcess().MainModule!.FileName;
Directory.CreateDirectory(DataDir);
SecureDataDir(DataDir);
if (!File.Exists(ConfigPath))
{
@@ -176,6 +177,30 @@ public class AgentWorker
catch { }
}
// Verzeichnis-ACL: nur SYSTEM/Administratoren — verhindert dass normale lokale User
// agent.log/status.json lesen (Hostname, letzter User, RDP-/Patch-Aktivität) oder manipulieren.
private static void SecureDataDir(string dir)
{
try
{
var di = new System.IO.DirectoryInfo(dir);
var acl = di.GetAccessControl();
acl.SetAccessRuleProtection(true, false);
acl.AddAccessRule(new System.Security.AccessControl.FileSystemAccessRule(
"SYSTEM", System.Security.AccessControl.FileSystemRights.FullControl,
System.Security.AccessControl.InheritanceFlags.ContainerInherit | System.Security.AccessControl.InheritanceFlags.ObjectInherit,
System.Security.AccessControl.PropagationFlags.None,
System.Security.AccessControl.AccessControlType.Allow));
acl.AddAccessRule(new System.Security.AccessControl.FileSystemAccessRule(
"Administrators", System.Security.AccessControl.FileSystemRights.FullControl,
System.Security.AccessControl.InheritanceFlags.ContainerInherit | System.Security.AccessControl.InheritanceFlags.ObjectInherit,
System.Security.AccessControl.PropagationFlags.None,
System.Security.AccessControl.AccessControlType.Allow));
di.SetAccessControl(acl);
}
catch { }
}
private static void SecureConfigFile(string path)
{
try

3
agent-cs/CaptureModeRunner.cs
View File

@@ -11,7 +11,7 @@ public static class CaptureModeRunner
private static readonly ImageCodecInfo JpegCodec =
ImageCodecInfo.GetImageEncoders().First(c => c.FormatID == ImageFormat.Jpeg.Guid);
public static void Run(string portStr, int screenIdx = 0)
public static void Run(string portStr, int screenIdx, string secret)
{
if (!int.TryParse(portStr, out var port) || port <= 0) return;
@@ -20,6 +20,7 @@ public static class CaptureModeRunner
using var tcp = new TcpClient();
tcp.Connect("127.0.0.1", port);
var stream = tcp.GetStream();
stream.Write(System.Text.Encoding.ASCII.GetBytes(secret));
var encParams = new EncoderParameters(1);
encParams.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, 60L);

4
agent-cs/ConsentModeRunner.cs
View File

@@ -5,14 +5,14 @@ namespace ITNexusAgent;
// Läuft als User-Prozess (via schtasks), zeigt Consent-Dialog und sendet Antwort via TCP
public static class ConsentModeRunner
{
public static void Run(string portStr)
public static void Run(string portStr, string secret)
{
if (!int.TryParse(portStr, out var port) || port <= 0) return;
var app = new System.Windows.Application();
app.ShutdownMode = System.Windows.ShutdownMode.OnMainWindowClose;
var win = new RdpConsentWindow(port);
var win = new RdpConsentWindow(port, secret);
win.Topmost = true;
win.Show();
win.Activate();

4
agent-cs/IT-Nexus-Agent.csproj
View File

@@ -7,8 +7,8 @@
<UseWindowsForms>true</UseWindowsForms>
<AssemblyName>IT-Nexus-Agent</AssemblyName>
<RootNamespace>ITNexusAgent</RootNamespace>
<Version>2.6.0</Version>
<AssemblyVersion>2.6.0.0</AssemblyVersion>
<Version>2.7.0</Version>
<AssemblyVersion>2.7.0.0</AssemblyVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<AllowUnsafeBlocks>false</AllowUnsafeBlocks>

4
agent-cs/IndicatorModeRunner.cs
View File

@@ -6,14 +6,14 @@ namespace ITNexusAgent;
// solange RDP-Session aktiv ist. User kann selbst trennen (TCP-Signal an Service).
public static class IndicatorModeRunner
{
public static void Run(string portStr)
public static void Run(string portStr, string secret)
{
if (!int.TryParse(portStr, out var port) || port <= 0) return;
var app = new System.Windows.Application();
app.ShutdownMode = System.Windows.ShutdownMode.OnMainWindowClose;
var win = new RdpActiveIndicatorWindow(port);
var win = new RdpActiveIndicatorWindow(port, secret);
win.Show();
app.Run();
}

11
agent-cs/Program.cs
View File

@@ -20,17 +20,22 @@ internal class Program
return;
case "--rdp-consent":
ConsentModeRunner.Run(args.Length > 1 ? args[1] : "");
ConsentModeRunner.Run(
args.Length > 1 ? args[1] : "",
args.Length > 2 ? args[2] : "");
return;
case "--rdp-capture":
CaptureModeRunner.Run(
args.Length > 1 ? args[1] : "",
args.Length > 2 && int.TryParse(args[2], out var si) ? si : 0);
args.Length > 2 && int.TryParse(args[2], out var si) ? si : 0,
args.Length > 3 ? args[3] : "");
return;
case "--rdp-indicator":
IndicatorModeRunner.Run(args.Length > 1 ? args[1] : "");
IndicatorModeRunner.Run(
args.Length > 1 ? args[1] : "",
args.Length > 2 ? args[2] : "");
return;
case "--dashboard":

75
agent-cs/Services/RtcService.cs
View File

@@ -2,6 +2,7 @@ using System.Diagnostics;
using System.Net;
using System.Net.Sockets;
using System.Net.WebSockets;
using System.Security.Cryptography;
using System.Text;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
@@ -112,15 +113,36 @@ public class RtcService
}
}
private static string GenerateSecret() => Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
// Liest exakt secret.Length Bytes und vergleicht zeitkonstant — verhindert, dass ein beliebiger
// lokaler Prozess sich als der gespawnte Helper ausgibt und Consent/Disconnect/Frames vortäuscht.
private static async Task<bool> ValidateSecretAsync(NetworkStream stream, string secret, CancellationToken ct)
{
var expected = Encoding.ASCII.GetBytes(secret);
var buf = new byte[expected.Length];
var read = 0;
while (read < buf.Length)
{
int n;
try { n = await stream.ReadAsync(buf.AsMemory(read, buf.Length - read), ct); }
catch { return false; }
if (n == 0) return false;
read += n;
}
return CryptographicOperations.FixedTimeEquals(buf, expected);
}
private async Task ConsentAndCaptureAsync(ClientWebSocket ws, int screenIdx, CancellationToken ct)
{
var exePath = System.Diagnostics.Process.GetCurrentProcess().MainModule!.FileName;
var secret = GenerateSecret();
var consentListener = new TcpListener(IPAddress.Loopback, 0);
consentListener.Start();
var consentPort = ((IPEndPoint)consentListener.LocalEndpoint).Port;
if (!SpawnConsentHelper(exePath, consentPort.ToString()))
if (!SpawnConsentHelper(exePath, consentPort.ToString(), secret))
{
consentListener.Stop();
AgentWorker.Log("RDP: Consent-Helper fehlgeschlagen, verweigere Zugriff");
@@ -140,9 +162,15 @@ public class RtcService
{
using var timeoutCts = new CancellationTokenSource(TimeSpan.FromSeconds(35));
using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeoutCts.Token);
using var tcp = await consentListener.AcceptTcpClientAsync(linked.Token);
var b = tcp.GetStream().ReadByte();
accepted = b == 1;
while (!linked.IsCancellationRequested)
{
using var tcp = await consentListener.AcceptTcpClientAsync(linked.Token);
var stream = tcp.GetStream();
if (!await ValidateSecretAsync(stream, secret, linked.Token)) continue; // fremder Connect-Versuch ohne gültiges Secret — ignorieren, weiter warten
var b = stream.ReadByte();
accepted = b == 1;
break;
}
}
catch { accepted = false; }
finally { consentListener.Stop(); }
@@ -174,6 +202,7 @@ public class RtcService
_indicatorListener = new TcpListener(IPAddress.Loopback, 0);
_indicatorListener.Start();
var port = ((IPEndPoint)_indicatorListener.LocalEndpoint).Port;
var secret = GenerateSecret();
_userDisconnectCts = new CancellationTokenSource();
var listener = _indicatorListener;
@@ -182,15 +211,21 @@ public class RtcService
{
try
{
using var tcp = await listener.AcceptTcpClientAsync();
tcp.GetStream().ReadByte();
disconnectCts.Cancel();
AgentWorker.Log("RDP: User hat über Overlay getrennt");
while (true)
{
using var tcp = await listener.AcceptTcpClientAsync();
var stream = tcp.GetStream();
if (!await ValidateSecretAsync(stream, secret, CancellationToken.None)) continue; // fremder Connect-Versuch ohne gültiges Secret
stream.ReadByte();
disconnectCts.Cancel();
AgentWorker.Log("RDP: User hat über Overlay getrennt");
break;
}
}
catch { }
});
_indicatorPid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-indicator {port}");
_indicatorPid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-indicator {port} {secret}");
}
catch (Exception ex)
{
@@ -198,22 +233,23 @@ public class RtcService
}
}
private static bool SpawnConsentHelper(string exePath, string portStr)
private static bool SpawnConsentHelper(string exePath, string portStr, string secret)
{
var pid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-consent {portStr}");
var pid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-consent {portStr} {secret}");
return pid > 0;
}
private async Task CapturePipeLoopAsync(ClientWebSocket ws, int screenIdx, CancellationToken ct)
{
var exePath = System.Diagnostics.Process.GetCurrentProcess().MainModule!.FileName;
var secret = GenerateSecret();
// TCP Loopback: kein ACL-Problem zwischen SYSTEM-Service und User-Prozess
var listener = new TcpListener(IPAddress.Loopback, 0);
listener.Start();
var port = ((IPEndPoint)listener.LocalEndpoint).Port;
if (!SpawnCaptureHelper(exePath, port.ToString(), screenIdx))
if (!SpawnCaptureHelper(exePath, port.ToString(), screenIdx, secret))
{
listener.Stop();
AgentWorker.Log("RDP: Helper-Start fehlgeschlagen");
@@ -225,7 +261,16 @@ public class RtcService
{
using var connectCts = new CancellationTokenSource(TimeSpan.FromSeconds(15));
using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct, connectCts.Token);
tcp = await listener.AcceptTcpClientAsync(linked.Token);
while (true)
{
var candidate = await listener.AcceptTcpClientAsync(linked.Token);
if (await ValidateSecretAsync(candidate.GetStream(), secret, linked.Token))
{
tcp = candidate;
break;
}
candidate.Dispose(); // fremder Connect-Versuch ohne gültiges Secret — verwerfen, weiter warten
}
}
catch
{
@@ -283,9 +328,9 @@ public class RtcService
AgentWorker.Log("RDP: Frame-Loop beendet");
}
private static bool SpawnCaptureHelper(string exePath, string portStr, int screenIdx = 0)
private static bool SpawnCaptureHelper(string exePath, string portStr, int screenIdx, string secret)
{
var pid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-capture {portStr} {screenIdx}");
var pid = SessionSpawner.SpawnInUserSession(exePath, $"--rdp-capture {portStr} {screenIdx} {secret}");
return pid > 0;
}
}

11
agent-cs/UI/RdpActiveIndicatorWindow.xaml.cs
View File

@@ -1,4 +1,5 @@
using System.Net.Sockets;
using System.Text;
using System.Windows;
using System.Windows.Media.Animation;
@@ -7,14 +8,16 @@ namespace ITNexusAgent.UI;
public partial class RdpActiveIndicatorWindow : Window
{
private readonly int _port;
private readonly string _secret;
private readonly DateTime _startedAt = DateTime.Now;
private readonly System.Windows.Threading.DispatcherTimer _timer = new();
private bool _signaled = false;
public RdpActiveIndicatorWindow(int port)
public RdpActiveIndicatorWindow(int port, string secret)
{
InitializeComponent();
_port = port;
_secret = secret;
Loaded += (s, e) =>
{
@@ -47,8 +50,10 @@ public partial class RdpActiveIndicatorWindow : Window
{
using var tcp = new TcpClient();
tcp.Connect("127.0.0.1", _port);
tcp.GetStream().WriteByte(1);
tcp.GetStream().Flush();
var stream = tcp.GetStream();
stream.Write(Encoding.ASCII.GetBytes(_secret));
stream.WriteByte(1);
stream.Flush();
}
catch { }
}

11
agent-cs/UI/RdpConsentWindow.xaml.cs
View File

@@ -1,4 +1,5 @@
using System.Net.Sockets;
using System.Text;
using System.Windows;
namespace ITNexusAgent.UI;
@@ -6,13 +7,15 @@ namespace ITNexusAgent.UI;
public partial class RdpConsentWindow : Window
{
private readonly int _port;
private readonly string _secret;
private bool _answered = false;
private System.Threading.CancellationTokenSource _countdownCts = new();
public RdpConsentWindow(int port)
public RdpConsentWindow(int port, string secret)
{
InitializeComponent();
_port = port;
_secret = secret;
_ = RunCountdownAsync(_countdownCts.Token);
}
@@ -53,8 +56,10 @@ public partial class RdpConsentWindow : Window
{
using var tcp = new TcpClient();
tcp.Connect("127.0.0.1", _port);
tcp.GetStream().WriteByte((byte)(accepted ? 1 : 0));
tcp.GetStream().Flush();
var stream = tcp.GetStream();
stream.Write(Encoding.ASCII.GetBytes(_secret));
stream.WriteByte((byte)(accepted ? 1 : 0));
stream.Flush();
}
catch { }
}

2
agent-cs/setup.iss
View File

@@ -1,5 +1,5 @@
#define MyAppName "IT Nexus Agent"
#define MyAppVersion "2.6.0"
#define MyAppVersion "2.7.0"
#define MyAppPublisher "Cereda Systems GmbH"
#define MyAppURL "https://it-nexus.cereda-systems.de"
#define MyAppExeName "IT-Nexus-Agent.exe"