mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 22:07:24 +00:00
CyberMind-FR
6f8a04fcad
GET /api/v1/users/users, /user/{username} and /export returned raw records
from users.json, which holds the argon2id password hash, the TOTP *secret*,
and the argon2id hashes of the TOTP backup codes.
All three routes are gated by `require_jwt` — ANY authenticated account, not
just an admin — so the lowest-privilege user could harvest every other
account's credentials. The TOTP secret alone lets an attacker mint valid
6-digit codes forever: a complete MFA bypass. This is a privilege-escalation
vector on a product whose own charter forbids secrets in clear.
/export was the worst: its comment said "Remove sensitive data" while dropping
only `provision_results`. A comment asserting a guarantee the code does not
provide is worse than no comment — it stops reviewers from looking.
Add redact_user() as the single place that decides what a client may see, and
route all three through it. `totp` is kept but reduced to its non-secret
metadata, and its PRESENCE is preserved: the webui shows the MFA badge on a
truthiness test (`u.totp_enabled || u.totp || u.mfa_enabled`), so dropping the
key would blank the badge and always emitting one would light it up for users
who never enrolled.
It lives in its own module rather than main.py because main.py reads the config
at import, so importing it requires read access to /etc/secubox/secubox.conf —
a security rule must stay testable without privileges.
Verified live on gk2 across all three routes: no argon2 hash, no TOTP secret,
no backup codes; totp_enabled still correct per account (admin true, gk2 and
operator false). Mutation-checked: restoring the passthrough fails 5 of the 9
tests.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
|
||
|---|---|---|
| .. | ||
| conftest.py | ||
| test_cli_api_parity.py | ||
| test_engine_lifecycle.py | ||
| test_engine_passwords.py | ||
| test_engine_sessions.py | ||
| test_engine_totp.py | ||
| test_migrate_v1_to_v2.py | ||
| test_password_policy.py | ||
| test_redaction.py | ||
| test_schema.py | ||
| test_totp.py | ||
| test_users_api_handlers.py | ||
| test_usersctl_cli.py | ||
| test_yacy_password_sync.py | ||