Page MenuHomePhabricator

OAuth credentials of Cradle tool are world-readable on Toolforge
Closed, ResolvedPublicSecurity

Description

lucaswerkmeister-wmde@tools-sgebastion-10:~$ ls -l ~tools.cradle/oauth.ini
-rw-r--r-- 1 tools.cradle tools.cradle 132 Jun 21  2020 /data/project/cradle/oauth.ini
lucaswerkmeister-wmde@tools-sgebastion-10:~$ cat ~tools.cradle/oauth.ini
[settings]
agent = cradle
consumerKey = 53acb74957ae0127da32a89d2f99bf02
consumerSecret = [REDACTED]

This consumer should be revoked immediately, since its credentials have been effectively public to all other Toolforge users for two years. Afterwards, @Magnus can make a private copy of the file (install -m600 oauth.ini oauth.ini.new), request and approve a new OAuth consumer, put its credentials in there, the overwrite the old file with the new one. (Don’t just chmod the old file – file permissions are checked when opening a file, not when reading from it, so chmod’ing an existing file doesn’t prevent users who already have an open file description for it from reading new information.)

Details

Risk Rating
High
Author Affiliation
Wikimedia Deutschland

Event Timeline

CCing @LucasWerkmeister so I can do something about this – I have Toolforge root as a volunteer (gained two months after this task was filed, see T314527) but security issue access only as staff lol

I chmoded the file.

lucaswerkmeister@tools-sgebastion-10:~$ ls -l ~tools.cradle/oauth.ini
-rw-r--r-- 1 tools.cradle tools.cradle 132 Jun 21  2020 /data/project/cradle/oauth.ini
lucaswerkmeister@tools-sgebastion-10:~$ sudo chmod go-rwx ~tools.cradle/oauth.ini # T314135
lucaswerkmeister@tools-sgebastion-10:~$ ls -l ~tools.cradle/oauth.ini
-rw------- 1 tools.cradle tools.cradle 132 Jun 21  2020 /data/project/cradle/oauth.ini

This doesn’t change the fact that the consumer was world-readable for almost three years, so it should still be revoked and replaced. But at least the file is no longer readable now.

Thanks, I'll replace it when I get a chance

JJMC89 claimed this task.
JJMC89 subscribed.

I've disabled the consumer since Magnus did not take the necessary action.

I think we can make this task public, by the way? (Users are starting to ask why the tool is broken, and AFAIK Magnus is the only one who can fix it.)

sbassett triaged this task as High priority.Dec 2 2024, 4:48 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to High.