BOINC Website Vulnerability

[TheAspens]

A vulnerability has been identified that will allow any user to create a specially crafted request and obtain the authenticator of any user of the system.

This vulnerability was added to the master branch on October 25, 2018 as part of merge commit 4198df0. It was fixed in the master branch on December 7th, 2018 as part of merge commit 1af5ecf.

The vulnerability was also present in server releases 1.0.0, 1.0.1 and 1.0.2 and is fixed in server release 1.0.3 (see https://github.com/BOINC/boinc/releases). It was not present in earlier versioned releases.

Projects who updated their website between October 25th, 2018 and December 7th, 2018 are strongly urged to update their website as soon as possible or to implement the workaround described below.

Thank you to Juha Sointusalo for identifying the vulnerability and thank you to Shawn Kwang for implementing the fix.

How Projects Can Check if Vulnerable:

If the file {PROJECT_DIR}/html/user/user_agreetermsofuse_action.php is not present, then you are not vulnerable.

If it is present, then run the following command from your project directory:

grep logintoken html/user/user_agreetermsofuse_action.php | wc -l

If it returns 0, then your project is vulnerable. If it returns something greater than or equal to 1, then your project has the fix.

Mitigation:

If you are not able to update your website immediately, then you can remove the risk by deleting the file:

{PROJECT_DIR}/html/user/user_agreetermsofuse_action.php

Since this will break the user consent code, then you need to set enable_login_mustagree_termsofuse to 0 in conflig.xml until you are able to update your website.

See https://boinc.berkeley.edu/trac/wiki/GdprCompliance for details about this setting.

[TheAspens]

This was fixed by #2890