Version 1.5.5 is a security release to fix an issue with API authentication.
- Fixed a timing attack security issue in the backend API endpoints to verify a submission, request statistics, and manage rule packages. Found and reported by senti-man via the security advisories (GHSA-9w98-5239-39c2).
- Fixed the wrong command name for the refresh rule package cron jobs. Reported by ffPjrZUGXfcxuAj in #435
Thank you, senti-man, for finding and reporting this issue to us in private via the security advisories.
We recommend updating to v1.5.5 as soon as you can.
Details of the security issue
Description of the security issue
The API endpoints use hashes to validate requests and grant access to the backend. We’ve wrongfully used a simple string comparison, which means that you could guess the private API key by measuring the time.
Risk assessment
The risk of this security issue is manageable. To exploit this issue, an attacker needs to make many requests (thousands) and needs favorable network conditions to guess the correct private key.
Even if the attacker found the private key, the only bad things the attacker could do are adding metadata to a submission and manipulating rule packages, if there are any, in a mosparo project.
It is not possible to request any form or user data. If an attacker successfully obtained the private key, they could only obtain metadata for a submission, project statistics, and the contents of a rule package.
Changes to mitigate the security issue
As suggested by senti-man, we’ve switched the hash comparison to the hash_equals method, which PHP provides specifically for this kind of attack.