New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix unauthorized message deletion #3893

Merged
merged 2 commits into from Oct 22, 2018

Conversation

Projects
None yet
2 participants
@heartsucker
Copy link
Contributor

heartsucker commented Oct 22, 2018

Status

Ready for review

Description of Changes

Fixes #3892

Fixes a bug where a source X could delete a reply from a journalist to source Y by guessing the ID.

Testing

See original ticket for the full description of the bug and manual steps to reproduce. There is a regression test for this so make test will cover this issue.

Deployment

This will not affect deployment.

Checklist

If you made changes to the server application code:

  • Linting (make ci-lint) and tests (make -C securedrop test) pass in the development container

heartsucker added some commits Sep 10, 2018

check ownership of reply before deletion
This patch fixes a bug where an authenticated source A could
delete the replies send to source B if they could guess the
filename. Since we don't throttle source interactions, and
since the wordlists are public, an attack could attempt to
enumerate them.

@heartsucker heartsucker requested a review from redshiftzero as a code owner Oct 22, 2018

@heartsucker heartsucker referenced this pull request Oct 22, 2018

Merged

[0.10.0] Fix unauthorized message deletion #3894

1 of 1 task complete
@emkll

emkll approved these changes Oct 22, 2018

Copy link
Contributor

emkll left a comment

Great find @heartsucker, thanks for the fix! Reproduced the bug and confirm the fixes solves the issue for me. Good to merge once CI passes.

@emkll emkll merged commit 81fe080 into develop Oct 22, 2018

5 checks passed

ci/circleci: admin-tests Your tests passed on CircleCI!
Details
ci/circleci: lint Your tests passed on CircleCI!
Details
ci/circleci: staging-test-with-rebase Your tests passed on CircleCI!
Details
ci/circleci: tests Your tests passed on CircleCI!
Details
ci/circleci: updater-gui-tests Your tests passed on CircleCI!
Details

@emkll emkll deleted the unauthorized-message-deletion branch Oct 22, 2018

@emkll emkll referenced this pull request Oct 23, 2018

Closed

Release SecureDrop 0.10.0 #3849

24 of 24 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment