Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Bug #336

Open
lukecampbell opened this issue Jun 14, 2015 · 3 comments
Open

Security Bug #336

lukecampbell opened this issue Jun 14, 2015 · 3 comments
Labels

Comments

@lukecampbell
Copy link
Contributor

https://github.com/asascience-open/ooi-ui-services/blob/84b8fbb83e1eda8953a341c6492a3acdca70413b/ooiservices/app/models.py#L1088-L1090

I played around with this, and if the application secret key is discovered or leaked then it's possible for arbitrary user escalation. If you encode the token using some secure salt then it will limit the ability for privilege escalation.

@lukecampbell
Copy link
Contributor Author

Here's proof, if I find out the application secret key, I can pretend log in as anyone by generating a token:

from itsdangerous import TimedJSONWebSignatureSerializer as Serializer

admin_user_id = 1
s = Serializer(exposed_key, expires_in=3600 * 24)
token = s.dumps({"id":admin_user_id})

@DanielJMaher
Copy link

@lukecampbell So is this really something we need to work with or is this a "Hey Rutgers, don't let people know the secret key!"

@lukecampbell
Copy link
Contributor Author

Rotating the secret keys, is a start.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants