fix: close the gaps a security review found in the default install
Reported against 2.2.1 by someone reading the source. Every finding held. **Sign-in had no ceiling.** Failures were logged with the caller's address and nothing more. Two counters now — one per address, one per account — because the two attacks look different: one source working through many accounts is caught by the first, many sources working on one account by the second, and behind a proxy only the second still means anything. The count is kept in the process that serves the request. PLANKA needs no Redis and the stock deployment is one container; run several and each keeps its own count, which multiplies the ceiling by their number. That trade is written where the limits are configured. **The second factor could be guessed at leisure.** Six digits, and a pending token that stayed valid for its full ten minutes however many codes were wrong. Wrong codes are now counted on the session row — in the database, so the count survives a restart and holds across every process — and when the budget is spent the session is destroyed. After that even the right code is refused and the login starts over from the password. **Avatars, background images and favicons** checked the token's signature and nothing else, so a revoked session, a deactivated account or a changed password all kept working there for as long as the signature lasted, which is a year by default. The five checks the API makes now live in one helper that both use, rather than the shortened copy that had drifted from it. **A link attachment's favicon** was fetched from wherever the URL pointed. Storing a link is harmless — it is a string the user typed — but fetching its icon is a request the server makes to an address the user chose, and whether an icon came back reported on what is reachable from inside the network. Server-side fetches now refuse private, loopback and link-local addresses, `169.254.169.254` among them. The attachment is still created: linking to an internal wiki is a legitimate thing to do, and it was the server's own request that had to stop. **The signing key.** Our own compose file ships `notsecretkey`, and it is printed in the documentation — so on any instance that copied it, anyone can sign a token for any account. PLANKA now says so on every start, and keeps saying it, along with a key that is missing or shorter than 32 characters. The placeholder carries the warning inline, where it is copied from. **The backup script** wrote password hashes, live sessions, TOTP secrets and SMTP credentials to an unencrypted archive. `BACKUP_PASSPHRASE` now encrypts it, and without one the script says what it just put on disk. It also says what it is — an example for the stock compose stack, not a backup concept — and names the window between the database dump and the file copy, which no ordering closes.
This commit is contained in:
Daniel Hiller
@@ -123,6 +123,9 @@ const Errors = {
|
||||
TERMS_ACCEPTANCE_REQUIRED: {
|
||||
termsAcceptanceRequired: 'Terms acceptance required',
|
||||
},
|
||||
RATE_LIMIT_EXCEEDED: {
|
||||
rateLimitExceeded: 'Rate limit exceeded',
|
||||
},
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
@@ -153,6 +156,9 @@ module.exports = {
|
||||
invalidPassword: {
|
||||
responseType: 'unauthorized',
|
||||
},
|
||||
rateLimitExceeded: {
|
||||
responseType: 'conflict',
|
||||
},
|
||||
termsAcceptanceRequired: {
|
||||
responseType: 'forbidden',
|
||||
},
|
||||
@@ -166,6 +172,36 @@ module.exports = {
|
||||
|
||||
async fn(inputs) {
|
||||
const remoteAddress = getRemoteAddress(this.req);
|
||||
|
||||
// Counted before the lookup, so a script cannot make the database do the
|
||||
// work of telling it that an account does not exist. Two counters: one
|
||||
// source against many accounts is caught per address, many sources against
|
||||
// one account per identifier — and behind a proxy only the second still
|
||||
// means anything, which is why both are here.
|
||||
const identifier = inputs.emailOrUsername.trim().toLowerCase();
|
||||
|
||||
// eslint-disable-next-line no-restricted-syntax
|
||||
for (const [key, max] of [
|
||||
[`auth:ip:${remoteAddress}`, sails.config.custom.authRateLimitMaxPerIp],
|
||||
[
|
||||
// Hashed so the key that lives in memory for the window is not the
|
||||
// address itself.
|
||||
`auth:identifier:${sails.helpers.utils.hash(identifier)}`,
|
||||
sails.config.custom.authRateLimitMaxPerIdentifier,
|
||||
],
|
||||
]) {
|
||||
const { isExceeded } = sails.helpers.utils.checkRateLimit.with({
|
||||
key,
|
||||
windowSeconds: sails.config.custom.authRateLimitWindow,
|
||||
max,
|
||||
});
|
||||
|
||||
if (isExceeded) {
|
||||
sails.log.warn(`Login rate limit hit (IP: ${remoteAddress})`);
|
||||
throw Errors.RATE_LIMIT_EXCEEDED;
|
||||
}
|
||||
}
|
||||
|
||||
const user = await User.qm.getOneActiveByEmailOrUsername(inputs.emailOrUsername);
|
||||
|
||||
if (!user) {
|
||||
|
||||
@@ -157,6 +157,24 @@ module.exports = {
|
||||
|
||||
if (!codeAccepted) {
|
||||
sails.log.warn(`Invalid TOTP code! (IP: ${remoteAddress})`);
|
||||
|
||||
// Incremented in the database rather than read-then-written, so two
|
||||
// requests racing on the same pending token cannot each see the old
|
||||
// count and spend the budget twice.
|
||||
const queryResult = await sails.sendNativeQuery(
|
||||
'UPDATE session SET pending_token_attempts = pending_token_attempts + 1, updated_at = $1 WHERE id = $2 RETURNING pending_token_attempts',
|
||||
[new Date().toISOString(), session.id],
|
||||
);
|
||||
|
||||
const [row] = queryResult.rows;
|
||||
|
||||
if (row && row.pending_token_attempts > sails.config.custom.totpMaxAttempts) {
|
||||
sails.log.warn(`TOTP attempts exhausted, dropping session (IP: ${remoteAddress})`);
|
||||
await Session.qm.deleteOneById(session.id);
|
||||
|
||||
throw Errors.INVALID_PENDING_TOKEN;
|
||||
}
|
||||
|
||||
throw Errors.INVALID_TOTP_CODE;
|
||||
}
|
||||
|
||||
|
||||
@@ -16,7 +16,14 @@ module.exports = {
|
||||
async fn(inputs) {
|
||||
const { hostname } = new URL(inputs.url);
|
||||
|
||||
if (!sails.helpers.utils.isPreloadedFaviconExists(hostname)) {
|
||||
// The link itself is only a stored string and stays whatever the user
|
||||
// typed. Fetching its favicon, though, is a request the SERVER makes to an
|
||||
// address the user chose — without a guard an editor could aim it at
|
||||
// `169.254.169.254` or an internal service and read the outcome from
|
||||
// whether an icon appeared.
|
||||
const isSafe = await sails.helpers.utils.isSafeRemoteUrl(inputs.url);
|
||||
|
||||
if (isSafe && !sails.helpers.utils.isPreloadedFaviconExists(hostname)) {
|
||||
await sails.helpers.utils.downloadFavicon(inputs.url);
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
/*!
|
||||
* Copyright (c) 2026 PLANKA Software GmbH
|
||||
* Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
|
||||
*/
|
||||
|
||||
// A fixed-window counter, held in the process that serves the request.
|
||||
//
|
||||
// PLANKA needs no Redis and the stock deployment is a single container, so the
|
||||
// count lives in memory rather than in shared storage. Run several processes
|
||||
// and each keeps its own, which multiplies the effective ceiling by their
|
||||
// number — enough to blunt a script, not a substitute for a limiter in front of
|
||||
// the app. That trade is stated where the limits are configured.
|
||||
//
|
||||
// The verdict comes back in the return value rather than as an exit: an exit
|
||||
// reaches an `await` as an Error wrapping its name, which is easy to catch
|
||||
// wrongly and easy to catch wrongly in silence.
|
||||
|
||||
const buckets = new Map();
|
||||
|
||||
// Beyond this many live keys, sweep what has expired before adding more. An
|
||||
// attacker can mint keys freely — one per made-up account name — so the map
|
||||
// must not be allowed to grow with them.
|
||||
const SWEEP_THRESHOLD = 10000;
|
||||
|
||||
const sweep = (now) => {
|
||||
buckets.forEach((bucket, key) => {
|
||||
if (bucket.expiresAt <= now) {
|
||||
buckets.delete(key);
|
||||
}
|
||||
});
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
inputs: {
|
||||
key: {
|
||||
type: 'string',
|
||||
required: true,
|
||||
},
|
||||
windowSeconds: {
|
||||
type: 'number',
|
||||
required: true,
|
||||
},
|
||||
max: {
|
||||
type: 'number',
|
||||
required: true,
|
||||
},
|
||||
},
|
||||
|
||||
sync: true,
|
||||
|
||||
fn(inputs) {
|
||||
const now = Date.now();
|
||||
|
||||
if (buckets.size > SWEEP_THRESHOLD) {
|
||||
sweep(now);
|
||||
}
|
||||
|
||||
const bucket = buckets.get(inputs.key);
|
||||
|
||||
if (!bucket || bucket.expiresAt <= now) {
|
||||
buckets.set(inputs.key, {
|
||||
count: 1,
|
||||
expiresAt: now + inputs.windowSeconds * 1000,
|
||||
});
|
||||
|
||||
return { count: 1, isExceeded: inputs.max < 1 };
|
||||
}
|
||||
|
||||
bucket.count += 1;
|
||||
|
||||
return { count: bucket.count, isExceeded: bucket.count > inputs.max };
|
||||
},
|
||||
};
|
||||
@@ -0,0 +1,107 @@
|
||||
/*!
|
||||
* Copyright (c) 2026 PLANKA Software GmbH
|
||||
* Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
|
||||
*/
|
||||
|
||||
// SSRF guard for server-side fetches of user-supplied URLs (link previews).
|
||||
// Rejects anything but http/https and any host that resolves to a private,
|
||||
// loopback, link-local or otherwise-internal address — so a pasted
|
||||
// `http://169.254.169.254/…` or `http://localhost:1337` can't reach the
|
||||
// internal network. When an outgoing proxy is configured, egress policy is the
|
||||
// proxy's responsibility and we defer to it.
|
||||
|
||||
const net = require('net');
|
||||
const dns = require('dns').promises;
|
||||
const { URL } = require('url');
|
||||
|
||||
const isPrivateIPv4 = (ip) => {
|
||||
const parts = ip.split('.').map((octet) => parseInt(octet, 10));
|
||||
if (parts.length !== 4 || parts.some((octet) => Number.isNaN(octet))) {
|
||||
return true;
|
||||
}
|
||||
const [a, b] = parts;
|
||||
return (
|
||||
a === 0 || // "this" network
|
||||
a === 10 ||
|
||||
a === 127 || // loopback
|
||||
(a === 100 && b >= 64 && b <= 127) || // CGNAT 100.64.0.0/10
|
||||
(a === 169 && b === 254) || // link-local (cloud metadata)
|
||||
(a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12
|
||||
(a === 192 && b === 168)
|
||||
);
|
||||
};
|
||||
|
||||
const LOCAL_IPV6_PREFIXES = ['fe8', 'fe9', 'fea', 'feb', 'fc', 'fd'];
|
||||
|
||||
const isPrivateIPv6 = (ip) => {
|
||||
const address = ip.toLowerCase();
|
||||
if (address === '::1' || address === '::') {
|
||||
return true;
|
||||
}
|
||||
// Link-local (fe80::/10) and unique-local (fc00::/7 → fc/fd prefixes).
|
||||
if (LOCAL_IPV6_PREFIXES.some((prefix) => address.startsWith(prefix))) {
|
||||
return true;
|
||||
}
|
||||
// IPv4-mapped (::ffff:a.b.c.d) — check the embedded v4.
|
||||
const mapped = address.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);
|
||||
if (mapped) {
|
||||
return isPrivateIPv4(mapped[1]);
|
||||
}
|
||||
return false;
|
||||
};
|
||||
|
||||
const isPrivateAddress = (ip) => {
|
||||
const family = net.isIP(ip);
|
||||
if (family === 4) {
|
||||
return isPrivateIPv4(ip);
|
||||
}
|
||||
if (family === 6) {
|
||||
return isPrivateIPv6(ip);
|
||||
}
|
||||
return true; // not a recognizable IP → treat as unsafe
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
inputs: {
|
||||
url: {
|
||||
type: 'string',
|
||||
required: true,
|
||||
},
|
||||
},
|
||||
|
||||
async fn(inputs) {
|
||||
let parsed;
|
||||
try {
|
||||
parsed = new URL(inputs.url);
|
||||
} catch (error) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Egress through a trusted proxy → let the proxy enforce destination policy.
|
||||
if (sails.config.custom.outgoingProxy) {
|
||||
return true;
|
||||
}
|
||||
|
||||
const host = parsed.hostname.toLowerCase();
|
||||
if (host === 'localhost' || host.endsWith('.localhost')) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (net.isIP(host)) {
|
||||
return !isPrivateAddress(host);
|
||||
}
|
||||
|
||||
let addresses;
|
||||
try {
|
||||
addresses = await dns.lookup(host, { all: true });
|
||||
} catch (error) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return addresses.length > 0 && addresses.every(({ address }) => !isPrivateAddress(address));
|
||||
},
|
||||
};
|
||||
@@ -0,0 +1,69 @@
|
||||
/*!
|
||||
* Copyright (c) 2026 PLANKA Software GmbH
|
||||
* Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
|
||||
*/
|
||||
|
||||
// Everything that has to be true before an access token means anything, in one
|
||||
// place. A valid signature is the first of five, not the whole answer: a token
|
||||
// keeps its signature after the session behind it was revoked, after the
|
||||
// account was deactivated, and after the password was changed — and the default
|
||||
// lifetime is a year.
|
||||
//
|
||||
// It lives here rather than inside the `current-user` hook because the routes
|
||||
// that serve avatars, background images and favicons need the same answer, and
|
||||
// when they had their own shortened version of it they let revoked tokens
|
||||
// through for as long as the signature lasted.
|
||||
//
|
||||
// Returns null whenever the token should not be honoured, so a caller cannot
|
||||
// mistake "no session" for a session.
|
||||
|
||||
module.exports = {
|
||||
inputs: {
|
||||
accessToken: {
|
||||
type: 'string',
|
||||
required: true,
|
||||
},
|
||||
// The paired cookie value, where the session was issued with one. A session
|
||||
// that carries an httpOnlyToken is only valid alongside its cookie.
|
||||
httpOnlyToken: {
|
||||
type: 'string',
|
||||
allowNull: true,
|
||||
},
|
||||
},
|
||||
|
||||
async fn(inputs) {
|
||||
let payload;
|
||||
try {
|
||||
payload = sails.helpers.utils.verifyJwtToken(inputs.accessToken);
|
||||
} catch (error) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const session = await Session.qm.getOneUndeletedByAccessToken(inputs.accessToken);
|
||||
|
||||
if (!session) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (session.httpOnlyToken && inputs.httpOnlyToken !== session.httpOnlyToken) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const user = await User.qm.getOneById(payload.subject, {
|
||||
withDeactivated: false,
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (user.passwordChangedAt > payload.issuedAt) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return {
|
||||
session,
|
||||
user,
|
||||
};
|
||||
},
|
||||
};
|
||||
@@ -15,42 +15,15 @@ module.exports = function defineCurrentUserHook(sails) {
|
||||
const TOKEN_PATTERN = /^Bearer /;
|
||||
const API_KEY_HEADER_NAME = 'x-api-key';
|
||||
|
||||
const getSessionAndUserByAccessToken = async (accessToken, httpOnlyToken) => {
|
||||
let payload;
|
||||
try {
|
||||
payload = sails.helpers.utils.verifyJwtToken(accessToken);
|
||||
} catch (error) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const session = await Session.qm.getOneUndeletedByAccessToken(accessToken);
|
||||
|
||||
if (!session) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (session.httpOnlyToken && httpOnlyToken !== session.httpOnlyToken) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const user = await User.qm.getOneById(payload.subject, {
|
||||
withDeactivated: false,
|
||||
// The five checks a token has to pass live in `utils/resolveAccessToken`,
|
||||
// shared with the routes that serve avatars and background images so the two
|
||||
// cannot answer differently.
|
||||
const getSessionAndUserByAccessToken = (accessToken, httpOnlyToken) =>
|
||||
sails.helpers.utils.resolveAccessToken.with({
|
||||
accessToken,
|
||||
httpOnlyToken: httpOnlyToken || null,
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (user.passwordChangedAt > payload.issuedAt) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return {
|
||||
session,
|
||||
user,
|
||||
};
|
||||
};
|
||||
|
||||
const getUserByApiKey = (apiKey) => {
|
||||
const apiKeyHash = sails.helpers.utils.hash(apiKey);
|
||||
|
||||
|
||||
@@ -28,6 +28,13 @@ module.exports = {
|
||||
allowNull: true,
|
||||
columnName: 'pending_token',
|
||||
},
|
||||
// Wrong second-factor codes entered against this pending token. Bounded by
|
||||
// `totpMaxAttempts`; reaching it destroys the session.
|
||||
pendingTokenAttempts: {
|
||||
type: 'number',
|
||||
defaultsTo: 0,
|
||||
columnName: 'pending_token_attempts',
|
||||
},
|
||||
httpOnlyToken: {
|
||||
type: 'string',
|
||||
isNotEmptyString: true,
|
||||
|
||||
Reference in New Issue
Block a user