[Autofic] Security Patch 2025-07-24

lib/modules/login.js

@@ -2,6 +2,14 @@ exports = module.exports = function(app, config) {
   var _ = require('lodash');
   var passport = require('passport');
   var ldapauth = require('passport-ldapauth');
+  var rateLimit = require('express-rate-limit');
+
+  // Rate limiter for login attempts
+  const loginLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // limit each IP to 100 requests per windowMs
+    message: "Too many login attempts from this IP, please try again after 15 minutes"
+  });
 
   // LDAP integration
   passport.use(new ldapauth.Strategy({
@@ -61,7 +69,7 @@ exports = module.exports = function(app, config) {
     res.render('login', { flash: req.flash() });
   });
 
-  app.post('/login', passport.authenticate('ldapauth', {
+  app.post('/login', loginLimiter, passport.authenticate('ldapauth', {
     successRedirect: '/',
     failureRedirect: '/login',
     failureFlash: true

lib/modules/pcap.js

@@ -28,22 +28,28 @@ function readRawBytes(size, transit) {
   return buffer;
 }
 
-
 exports = module.exports = function(app, config) {
   var _ = require('lodash');
   var fs = require('fs');
   var spawn = require('child_process').spawn;
   var querystring = require('querystring');
   var XmlStream = require('xml-stream');
+  var rateLimit = require('express-rate-limit');
+
+  // Rate limiting middleware
+  const limiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100 // limit each IP to 100 requests per windowMs
+  });
 
   // Mock pcap service for use in development
   if (config.pcap.mock) {
-    app.get('/sample/pcap/:command', function(req, res) {
+    app.get('/sample/pcap/:command', limiter, function(req, res) {
       res.sendFile('/vagrant/seed/opensoc.pcap');
     });
   }
 
-  app.get('/pcap/:command', function(req, res) {
+  app.get('/pcap/:command', limiter, function(req, res) {
     if (config.auth && (!req.user || !req.user.permissions.pcap)) {
       res.send(403, 'Forbidden!');
       return;

lib/opensoc-ui.js

@@ -1,5 +1,7 @@
 var _ = require('lodash');
 var http = require('http');
+var https = require('https');
+var fs = require('fs');
 var path = require('path');
 
 var express = require('express');
@@ -10,6 +12,8 @@ var flash = require('connect-flash');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
 var cookieSession = require('cookie-session');
+var csurf = require('csurf');
+var helmet = require('helmet');
 
 var passport = require('passport');
 var ldapauth = require('passport-ldapauth');
@@ -24,13 +28,19 @@ var app = express();
 app.set('view engine', 'jade');
 app.set('views', path.join(__dirname, 'views/'));
 
+// Use Helmet to secure Express apps by setting various HTTP headers
+app.use(helmet());
+
 // Cookie middleware
 app.use(connect.logger('dev'));
 app.use(flash());
 app.use(cookieParser());
 app.use(cookieSession({
   secret: config.secret,
-  cookie: {maxAge: 1 * 24 * 60 * 60 * 1000} // 1-day sessions
+  cookie: {
+    maxAge: 1 * 24 * 60 * 60 * 1000, // 1-day sessions
+    secure: true // Ensure cookies are only sent over HTTPS
+  }
 }));
 
 if (config.auth) {
@@ -42,7 +52,7 @@ app.use("/__es", esProxy(config));
 
 app.use(bodyParser.urlencoded({extended: true}));
 app.use(bodyParser.json());
-
+app.use(csurf()); // Add CSRF protection
 
 // Setup routes
 if (config.auth) {
@@ -51,7 +61,6 @@ if (config.auth) {
 
 pcap(app, config);
 
-
 app.get('/config.js', function (req, res) {
   if (config.auth && !req.user) {
     res.send(403, 'Forbidden!');
@@ -67,8 +76,12 @@ app.use(connect.static(path.join(__dirname, config.static)));
 // Start server
 if (process.env.NODE_ENV != 'TEST') {
   console.log('Starting server on port', config.port, '...');
-  var server = http.createServer(app);
+  var serverOptions = {
+    key: fs.readFileSync('path/to/your/private-key.pem'),
+    cert: fs.readFileSync('path/to/your/certificate.pem')
+  };
+  var server = https.createServer(serverOptions, app);
   server.listen(config.port, config.host);  
 }
 
-exports.app = app;
+exports.app = app;

test/session-test.js

@@ -22,7 +22,7 @@ if (!process.env.IN_TRAVIS) {
       it('logs in', function (done) {
         session.
           post('/login').
-          send({ email: 'joesmith@opensoc.dev', password: 'opensoc' }).
+          send({ email: process.env.TEST_EMAIL, password: process.env.TEST_PASSWORD }).
           end(function (err, res) {
             // redirects to home
             assert.equal(res.header['location'], '/');