Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hardcoded secret key #222

Open
FHantke opened this issue May 20, 2024 · 1 comment · May be fixed by #223
Open

Hardcoded secret key #222

FHantke opened this issue May 20, 2024 · 1 comment · May be fixed by #223

Comments

@FHantke
Copy link

FHantke commented May 20, 2024

Hello Haldis developers,

We are a cybersecurity research group from the CISPA Helmholtz Center for Information Security and Ca’ Foscari University of Venice. We recently conducted an analysis of the session management used in your web application as part of our research. We have discovered a security vulnerability that we believe requires your attention.

Vulnerability Description:

After our analysis, we have identified that your application is using a hard-coded secret key that is leaked through GitHub. If operators who install your web application do not change this secret key, they are vulnerable to cookie forgeries. The cookie forgery attack allows an attacker, knowing the key used to sign a cookie, to forge new arbitrary cookies to impersonate and take over other accounts.

SECRET_KEY = "<change>"

Recommendation for Mitigation:

To address this vulnerability and enhance the security posture of your web application, we highly recommend setting the secret key from an environment variable. If the environment file is not shared on GitHub then this would force operators of your application to create their own key upon installation, forcing them to set their own secure secret key.

We hope this notification helps improve your security. Should you have further questions or comments on this feel free to answer this thread or reach out to [email protected].

Kind regards,
Florian Hantke

@TomNaessens
Copy link
Member

Hi @FHantke,

Thank you for the warning. I'd consider this a false positive though: the action of having to copy config.example.py to config.py, together with the "change" instruction in the file should be sufficient mitigation.

Nevertheless, I've changed it to an environment variable in #223.

Tom

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants