Avatar endpoint accessible without authentication

[scruplelesswizard]

Your Rocket.Chat version: 0.33.0

The /avatar endpoint is accessible without being authentication.

This creates two security related issues:

1. As user avatars are stored by using the username as the file name, this provides an attacker with an easily exploitable method of getting valid user names.
2. Private information (the avatar photos) is accessible to unauthenticated parties.

Two proposed mitigations:

1. Store user avatars using a hash of the username as the filename.
2. Require an authenticated user before allowing access to the /avatars endpoint or return an HTTP 401

[MartinSchoeler]

This issue was not fixed on #6788 and was closed by mistake

[Lemmmy]

Can we increase the priority on this issue? It can be a pretty abusable security issue.

[jgtoriginal]

@Lemmmy not sure about that, but you can always put a bounty on it.
https://www.bountysource.com/issues/34942815-avatar-endpoint-accessible-without-authentication

[Lemmmy]

Good call, thank you.

[localguru]

Anything new on this?

[amaranto]

+1 !

[cjpabloL]

+1 !

[bbrauns]

privacy nightmare...

[localguru]

Still in 0.58.4 and 0.59.0

[jthomae1]

+1!

[javiergoni]

+1!

[scruplelesswizard]

Just wanted to note that we dropped Rocket Chat about a month after I posted this due to all the security issues. We even posted a patch for this issue which wasn't accepted as it might break integrations. Two years later, this still is an issue... Rocket Chat showed a lot of promise, but being insecure by default and refusing to correct the errors means that Rocket Chat isn't a real option, especially not for any European entity since GDPR has come in to effect.

[ashishbhate]

Just wanted to note that we dropped Rocket Chat about a month after I posted this...

what are you using instead?

[sampaiodiego]

@chaosaffe we're sorry to hear that you dropped Rocket.Chat. I don't see how this affects GDPR, can you please explain? We've done other important improvements to be GDPR compliant (which you can see here #9769), but we might have missed this one.

Also as you may noticed there is a opened PR #9749 waiting for changes to be able to be merged. It's now prioritized to be merged next month, so I'll make sure the changes are made until there.

[localguru]

@sampaiodiego please reopen as this is still an issue in 0.69.2 and we don't want to forget it ;)

[sampaiodiego]

@localguru there is now an option under Accounts > Avatar that you can block unauthenticated access to avatars: