Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Note re-creation vulnerability #57

Open
ekoyle opened this issue Jan 21, 2020 · 12 comments · May be fixed by #58 or #59
Open

Note re-creation vulnerability #57

ekoyle opened this issue Jan 21, 2020 · 12 comments · May be fixed by #58 or #59

Comments

@ekoyle
Copy link

ekoyle commented Jan 21, 2020

The web UI will allow a client-generated private id to be used (by altering the value of the hidden new_url input), which allows a malicious user to view and/or modify a note without detection.

After viewing the note, the malicious user only needs to re-create it using the same private id and (optional) passphrase. The note could be identical or modified, and there is no way for the intended recipient to detect this. A note can also be overwritten without being viewed first if the private id is known.

I recommend using a server-side secret to validate that the private id was generated on the server and not by a malicious user. It would also be a good idea to include a timestamp to validate the private id was generated recently.
ekoyle added a commit to ekoyle/d-note that referenced this issue Jan 22, 2020
@ekoyle
Sign form to ensure it is not tampered with
71f0025 
This adds a server secret and uses it to sign the generated url with a
timestamp to prevent client-side tampering.

fixes atoponce#57
@ekoyle ekoyle linked a pull request Jan 22, 2020 that will close this issue
Open
@DFF-fred
Copy link

I updated my installation but am now getting a 500 error. The error.log file says:
UndefinedError: 'note' is undefined
Where should I define it, and how?

@ekoyle
Copy link
Author

ekoyle commented Jan 22, 2020 via email

@DFF-fred
Copy link

DFF-fred commented Jan 23, 2020 •
edited
Loading

Yes there is a traceback. Here it is:
[2020-01-22 09:14:03,309] ERROR in app: Exception on / [GET]
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1982, in wsgi_app
response = self.full_dispatch_request()
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1614, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1517, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1612, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1598, in dispatch_request
return self.view_functionsrule.endpoint
File "/usr/local/lib/python2.7/dist-packages/dnote-1.0.1-py2.7.egg/dnote/init.py", line 15, in index
return render_template('index.html', random=note.url, error=error)
File "/usr/lib/python2.7/dist-packages/flask/templating.py", line 134, in render_template
context, ctx.app)
File "/usr/lib/python2.7/dist-packages/flask/templating.py", line 116, in _render
rv = template.render(context)
File "/usr/lib/python2.7/dist-packages/jinja2/environment.py", line 1008, in render
return self.environment.handle_exception(exc_info, True)
File "/usr/lib/python2.7/dist-packages/jinja2/environment.py", line 780, in handle_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python2.7/dist-packages/dnote-1.0.1-py2.7.egg/dnote/templates/index.html", line 1, in top-level template code
{% extends "base.html" %}
File "/usr/local/lib/python2.7/dist-packages/dnote-1.0.1-py2.7.egg/dnote/templates/base.html", line 73, in top-level template code
{% block content %}{% endblock %}
File "/usr/local/lib/python2.7/dist-packages/dnote-1.0.1-py2.7.egg/dnote/templates/index.html", line 27, in block "content"
<input name="new_url" type="hidden" value="{{ note.url }}" />
File "/usr/lib/python2.7/dist-packages/jinja2/environment.py", line 430, in getattr
return getattr(obj, attribute)
UndefinedError: 'note' is undefined

Also I didn't find any dnote.py. Are you referring to d-note.ini or note.py?

Thank you.

@ekoyle
Copy link
Author

ekoyle commented Jan 23, 2020 via email

@DFF-fred
Copy link

Indeed I had 2 files out of 4 not updated. For some reasons Github is showing me the old version of the files, but the page with the changes is ok. Anyway I now think I did the changes right and the app is showing. Unfortunately when I click on Submit I get this:
"Your request appears to have been tampered with. Please try again.
error: could not convert string to float: None"
And I didn't find any dnote.py. Are you referring to the 2 extra lines in generate_dnote_hashes? Then it reads from d-note.ini and generates a dconfig.py and I can see those 2 extra variables in it.

@ekoyle
Copy link
Author

ekoyle commented Jan 24, 2020 via email

@DFF-fred
Copy link

oh.. well I think I verified the 5 files and they are similar now. I'll try to do that and revert to you, but might not happen right away as I need to go out right now. I'll let you know then.
Thank you.

@DFF-fred
Copy link

DFF-fred commented Jan 24, 2020 •
edited
Loading

So yes your branch works. I need to figure out what's not working in my version... Thank you very much for your help.
ps: I just copied the template folder and it worked. I guess I must have omitted one of the changes when I manually added them. Thanks again for this great software!

@ekoyle
Copy link
Author

ekoyle commented Jan 28, 2020

@santiago-usu recommended just removing that variable from the, but I thought it was used by the hashcash validation. Upon further inspection, that does not appear to be the case.

Maybe it would be better to wait until after the post to generate the private_id/new_url?

Also, I kind of question the usefulness of the hashcash operation as it is implemented... the server isn't validating the browser fingerprint (not sure if this is possible), the date, or any other part of it besides ensuring the hash of it starts with '0000' -- the only restriction is that the token has not been used before. It would be trivial to find a long list of valid hashcash tokens.

@ekoyle ekoyle linked a pull request Jan 28, 2020 that will close this issue
Open
@DFF-fred
Copy link

DFF-fred commented Mar 27, 2020 •
edited
Loading

Hi! Note sure what is happening but the application suddenly stopped working. I reinstalled (a few times) and it seems the main repository is still at the old version? I also did an install from your as instructed above and am getting the same problem:

  • On the same browser the 'secret' note opens or destroys
  • if I send the note to a 3rd party by email or messaging app it fails saying "Error. The page you have requested cannot be found".

Looking into dnote/data I do not see any file create or hashcash.db as mentioned in the troubleshooting section and I set the data dir as 777
Any idea?

ps: I am having the same issue at https://ae7.st/d/

@ekoyle
Copy link
Author

ekoyle commented Mar 31, 2020

@DFF-fred this project doesn't seem to be maintained anymore. There are also some security concerns, the biggest of which is that the server gets every message in plain-text. Also, python2 is no longer supported.

My second PR (#59) is the simplest fix for this issue.

@DFF-fred
Copy link

DFF-fred commented Apr 1, 2020

Hi! Well thank you for the feedback. I've struggled a bit and finally found another maintained project doing the same called PrivateBin on github as well. Seems to be running fine so far.

Thanks again for your help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@ekoyle @DFF-fred