100 lines
3.6 KiB
Markdown
100 lines
3.6 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting Security Issues
|
|
|
|
If you discover a security vulnerability in AdminLTE, please report it by emailing the maintainers or opening a private security advisory on GitHub. We take security seriously and will respond promptly.
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 4.x | :white_check_mark: |
|
|
| 3.x | :x: |
|
|
| < 3.0 | :x: |
|
|
|
|
## Security Best Practices
|
|
|
|
AdminLTE is a frontend admin dashboard template. When deploying applications built with AdminLTE, follow these security best practices:
|
|
|
|
### 1. Production Deployment
|
|
|
|
- **Never expose `node_modules` directory** in production environments
|
|
- **Remove demo/example files** (like `index2.html`, `index3.html`) from production builds
|
|
- **Use a proper build process** that only includes necessary production assets
|
|
- **Configure web server properly** to prevent directory traversal attacks
|
|
|
|
### 2. Build Process
|
|
|
|
When deploying to production:
|
|
|
|
```bash
|
|
# Build only production assets
|
|
npm run production
|
|
|
|
# Deploy only the dist/ directory contents you need
|
|
# Typically: dist/js/adminlte.min.js and dist/css/adminlte.min.css
|
|
```
|
|
|
|
### 3. What NOT to Deploy
|
|
|
|
Do not deploy these to production:
|
|
- `node_modules/` directory
|
|
- Example/demo HTML files (`index.html`, `index2.html`, `index3.html`, etc.)
|
|
- Source files (`src/` directory)
|
|
- Development configuration files
|
|
- Documentation files
|
|
|
|
## Known CVE Issues
|
|
|
|
### CVE-2021-36471 (Disputed)
|
|
|
|
**Status**: This CVE is **disputed** and does not represent a vulnerability in AdminLTE itself.
|
|
|
|
**Issue**: CVE-2021-36471 claims AdminLTE 3.1.0 has a "Directory Traversal vulnerability" that allows remote attackers to view demo pages via `/admin/index2.html` and `/admin/index3.html`.
|
|
|
|
**Clarification**:
|
|
- The `index2.html` and `index3.html` files are **example/demo pages** intended for developer reference during development
|
|
- This is **not a vulnerability in AdminLTE** - it is a **deployment misconfiguration** by website developers
|
|
- The issue occurs when developers incorrectly deploy:
|
|
- Their entire `node_modules` folder publicly
|
|
- Demo/example files in production environments
|
|
- Without proper web server configuration
|
|
|
|
**Resolution**:
|
|
- AdminLTE 4.x has restructured the project architecture with clear separation between development demos and production assets
|
|
- Follow the production deployment best practices above
|
|
- Only deploy the compiled production assets from `dist/js/` and `dist/css/`
|
|
- The original CVE researcher acknowledged this should be classified as low/info severity, not critical
|
|
|
|
**For More Information**:
|
|
- [GitHub Issue #4948](https://github.com/ColorlibHQ/AdminLTE/issues/4948)
|
|
- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2021-36471) (marked as disputed)
|
|
|
|
## Secure Development
|
|
|
|
### Content Security Policy (CSP)
|
|
|
|
When implementing AdminLTE in your application, consider adding appropriate Content Security Policy headers to prevent XSS attacks.
|
|
|
|
### Authentication & Authorization
|
|
|
|
AdminLTE is a **UI template only** and does not include authentication or authorization. You must:
|
|
- Implement proper authentication in your backend
|
|
- Secure all API endpoints
|
|
- Use HTTPS in production
|
|
- Implement proper session management
|
|
- Follow OWASP security guidelines
|
|
|
|
### Dependencies
|
|
|
|
- Keep AdminLTE and its dependencies up to date
|
|
- Regularly run `npm audit` to check for vulnerabilities
|
|
- Review security advisories for Bootstrap and other dependencies
|
|
|
|
## Contact
|
|
|
|
For security concerns, please contact the maintainers through:
|
|
- GitHub Issues (for general questions)
|
|
- GitHub Security Advisories (for sensitive security issues)
|
|
- Project maintainer email (check package.json)
|