Permissions issue with enigma plugin allows exfiltration of secret gpg key file

[exploitagency]

Although this not exactly access to the secret key since it is password protected you still have to crack it.

See my reference here.

https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt

[alecpl]

I'm not sure what we could do here. Securing that directory is the same as securing the temp_dir of Roundcube. There's .htaccess file. It's also not writable by default so users have to set permissions (or the folder location) by their own.

We could only add additional warning in README and sample config.

[exploitagency]

I suppose using a strong password is in order and keep outside of the web folders like www.

[thomascube]

The best way is to move it out of the webserver's document root tree and configure the location with $config['enigma_pgp_homedir']. Maybe we should enforce people to deliberately chose a location and always configure the homedir by removing the default of having it inside the plugins directory which by definition has to be accessible by the webserver.

[exploitagency]

The problem is nginx doesn't use the .htaccess files provided and all of these automated install scripts use nginx as the web server.

Reference https://bitbucket.org/zhb/iredmail/issues/130/multiple-security-issues-with-default

[alecpl]

Fixed by adding some notes to README and removing default value for enigma_pgp_homedir.

[exploitagency]

👍 Thanks