pretix

Security release 2023.7.1 of pretix

11. Sept. 2023

Today, we've internally discovered a security issue inside pretix. We therefore just released versions 2023.7.1, 2023.6.1, and 4.20.2 of pretix that fix this problem. It is strongly recommended that you update your installation as soon as possible.

This security issue only affects self-hosted versions of pretix. If you are a customer of our pretix Hosted service, you are not affected.

#1: Incorrect configuration parsing leading to incorrect handling of HTTP headers [MEDIUM]

CVE ID: CVE-2023-44463

pretix is usually deployed behind a reverse proxy and can therefore handle the X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers to get access to the original source IP address, host name and protocol used by the client.

This behaviour is off by default and needs to be enabled in the pretix.cfg configuration file like this:

trust_x_forwarded_for=on
trust_x_forwarded_proto=on
trust_x_forwarded_host=on

However, there was a bug in parsing these configuration values and the headers have been trusted even if the settings have been set to off. More specifically, as long as the configuration flags have been set, regardless of their value, they have been considered on. The headers have only been ignored if the configuration flags have been missing entirely.

Severity rating: The security impact on a typical pretix installation is low since our installation guide recommends setting the flags to on and recommends a safe reverse proxy config that controls these headers. A security problem arises if (a) a reverse proxy config is used that allows the user to set these headers themselves and (b) the config flags have been turned off explicitly. Additionally, the impact in this case is limited since pretix itself does not use the host name or IP address for access control. The biggest impact within pretix is that some rate-limiting features are based on IP addresses and could be circumvented. A higher impact would be possible if additional access control based on host names is used in addition to pretix, or if a plugin relies on correct IP addresses for other reasons. We therefore assess the severity of this issue as medium.

Affected versions: pretix versions 3.0.0 until 2023.7.0 are affected.

This issue has been found internally.

Fixed versions

All pretix installations are affected. We just released updates for the last three stable versions on PyPI that fix the problem. If you run a pretix installation older than 4.20, please upgrade to a recent version now.

The new docker images will appear on Docker Hub over the next few hours.

We strongly recommend that you always run the latest version of pretix, as every release contains useful and important bug fixes, even if they are not security related.

If you want to keep updated about bugfix and security releases, you should follow this blog closely. A RSS feed is available and we also announce every blogpost on Mastodon.

We take the security of our product very seriously and always go the extra mile to make sure you stay safe. As we are humans, security issues unfortunately still might occur from time to time. We do everything we can to find and fix them as timely as we can. If you notice any security problems or have any questions on this topic, please contact us in private at security@pretix.eu. We will always treat your message with the appropriate priority.

Raphael Michel

Raphael ist der Gründer und Haupt-Entwickler von pretix. Er begeistert sich für benutzerfreundliche, elegante Software und wenn er nicht zu beschäftigt mit pretix ist, organisiert er gerne selbst Konferenzen mit.

Mehr Blog-Posts lesen

Noch Fragen?
+49 6221 32177-50 Mo-Fr 09:00-17:00 Uhr