Hardcoded secret key

[FHantke]

Hello ActiveDriverDB developers,

We are a cybersecurity research group from the CISPA Helmholtz Center for Information Security and Ca’ Foscari University of Venice. We recently conducted an analysis of the session management used in your web application as part of our research. We have discovered a security vulnerability that we believe requires your attention.

Vulnerability Description:

After our analysis, we have identified that your application is using a hard-coded secret key that is leaked through GitHub. If operators who install your web application do not change this secret key, they are vulnerable to cookie forgeries. The cookie forgery attack allows an attacker, knowing the key used to sign a cookie, to forge new arbitrary cookies to impersonate and take over other accounts.

ActiveDriverDB/website/example_config.py

Line 19 in e47050b

SECRET_KEY = 'replace_this'

Recommendation for Mitigation:

To address this vulnerability and enhance the security posture of your web application, we highly recommend setting the secret key from an environment variable. If the environment file is not shared on GitHub then this would force operators of your application to create their own key upon installation, forcing them to set their own secure secret key.

We hope this notification helps improve your security. Should you have further questions or comments on this feel free to answer this thread or reach out to florian.hantke@cispa.de.

Kind regards,
Florian Hantke

[krassowski]

Thank you. This file is not a part of the application. It is an example, as the name suggests.

[FHantke]

Thank you for the answer. Although this is only an example file, I'd still suggest to change the example to use environment variables instead of a hardcoded key as the example demonstrate best practices, right? More often than not, people just copy paste example files for their own setup.