github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-07 21:30:36 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #1053] Unsafe first setup of administrator credentials on fully exposed website #6535

New Issue
Closed
opened 2026-04-25 15:25:47 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-25 15:25:47 -05:00
Owner
Copy Link

Originally created by @ackalker on GitHub (Jul 11, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1053

The current installation process requires setting up administrator credentials via a web browser, leaving the Pangolin server unsecured and fully exposed to the internet during this period. This creates a critical security window where an attacker could claim the administrator account and gain access to all proxied resources.

Previously, administrator setup was handled securely via the terminal (see commit d03f452). I strongly recommend restoring this option or, at minimum, providing a way to restrict or protect the initial web-based setup (e.g., setup tokens, IP whitelisting, or time-limited URLs).

Potential Impact:

  • Unauthorized control of Pangolin instance
  • Exposure of all connected services
  • Possible lateral movement within private networks

Recommendations:

  • Restore terminal-based admin setup
  • Make web-based setup optional or protected
  • Consider additional mitigations to limit attack surface during setup
Originally created by @ackalker on GitHub (Jul 11, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1053 The current installation process requires setting up administrator credentials via a web browser, leaving the Pangolin server unsecured and fully exposed to the internet during this period. This creates a critical security window where an attacker could claim the administrator account and gain access to all proxied resources. Previously, administrator setup was handled securely via the terminal (see commit d03f452). I strongly recommend restoring this option or, at minimum, providing a way to restrict or protect the initial web-based setup (e.g., setup tokens, IP whitelisting, or time-limited URLs). Potential Impact: - Unauthorized control of Pangolin instance - Exposure of all connected services - Possible lateral movement within private networks Recommendations: - Restore terminal-based admin setup - Make web-based setup optional or protected - Consider additional mitigations to limit attack surface during setup
GiteaMirror added the stale label 2026-04-25 15:25:47 -05:00
GiteaMirror commented 2026-04-25 15:25:48 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Jul 12, 2025):

Hi, thanks. We introduced the terminal based CLI tool and the initial GUI setup simultaneously because the previous versions required the password be set in a file which wasn't ideal for many.

If someone beat you to the setup page to create the credentials they would control that account, but since the instance is empty at this point in time, you could also clear the DB or reset the password with the CLI since you control the server. Once the admin account is created, it cannot be changed or manipulated via the GUI, you have to use the CLI.

We can work on making this opt out via a question in the installer for those who would prefer to signup the first user via the CLI only.

<!-- gh-comment-id:3065952902 --> @miloschwartz commented on GitHub (Jul 12, 2025): Hi, thanks. We introduced the terminal based CLI tool and the initial GUI setup simultaneously because the previous versions required the password be set in a file which wasn't ideal for many. If someone beat you to the setup page to create the credentials they would control that account, but since the instance is empty at this point in time, you could also clear the DB or reset the password with the CLI since you control the server. Once the admin account is created, it cannot be changed or manipulated via the GUI, you have to use the CLI. We can work on making this opt out via a question in the installer for those who would prefer to signup the first user via the CLI only.
GiteaMirror commented 2026-04-25 15:25:48 -05:00
Author
Owner
Copy Link

@inspectorgadjet7 commented on GitHub (Jul 17, 2025):

Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it.

<!-- gh-comment-id:3084967941 --> @inspectorgadjet7 commented on GitHub (Jul 17, 2025): Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it.
GiteaMirror commented 2026-04-25 15:25:49 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Jul 21, 2025):

@inspectorgadjet7 Good idea!

<!-- gh-comment-id:3097856768 --> @miloschwartz commented on GitHub (Jul 21, 2025): @inspectorgadjet7 Good idea!
GiteaMirror commented 2026-04-25 15:25:49 -05:00
Author
Owner
Copy Link

@TheBigBear commented on GitHub (Jul 23, 2025):

This is unsafe as the ticket says.
Two suggestions, maybe the installer should prompt for an initial IP to be allowed for initial administrator credentials changes or setup, or it should generate some random long string it displays during setup that the owner has to use to connect.

<!-- gh-comment-id:3109248467 --> @TheBigBear commented on GitHub (Jul 23, 2025): This is unsafe as the ticket says. Two suggestions, maybe the installer should prompt for an initial IP to be allowed for initial administrator credentials changes or setup, or it should generate some random long string it displays during setup that the owner has to use to connect.
GiteaMirror commented 2026-04-25 15:25:50 -05:00
Author
Owner
Copy Link

@Error-Gap commented on GitHub (Jul 26, 2025):

Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it.

The docker container pretty much automatically creates the rules that open ports though, and not everyone is running a configurable firewall in front of their instance (especially if they're hosted).

An easy way to safeguard this would be:
Require an secret in the config file in order to create the admin account
i.e.

server:
        admin_token: "password123"

Then prompt for it at the initial account creation page. That way the only person who should have access to the secret is going to be somebody with admin access to the server it's hosted on.

<!-- gh-comment-id:3121228912 --> @Error-Gap commented on GitHub (Jul 26, 2025): > Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it. The docker container pretty much automatically creates the rules that open ports though, and not everyone is running a configurable firewall in front of their instance (especially if they're hosted). An easy way to safeguard this would be: Require an secret in the config file in order to create the admin account i.e. ``` server: admin_token: "password123" ``` Then prompt for it at the initial account creation page. That way the only person who should have access to the secret is going to be somebody with admin access to the server it's hosted on.
GiteaMirror commented 2026-04-25 15:25:50 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Aug 10, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

<!-- gh-comment-id:3172261443 --> @github-actions[bot] commented on GitHub (Aug 10, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2026-04-25 15:25:51 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Aug 16, 2025):

Resolved by #1208

<!-- gh-comment-id:3193384783 --> @oschwartz10612 commented on GitHub (Aug 16, 2025): Resolved by #1208
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#6535
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?