search

EmerisHQ / demeris

Emeris web app
https://app.emeris.com/
Apache License 2.0
11 stars 2 forks source link

From Audit: Excessive Storage of Password #1778

Closed josietyleung closed 2 years ago

josietyleung commented 2 years ago

Synopsis The password used to decrypt the Emeris browser extension wallet is stored in the session storage and is used in the changePassword function so that the wallet’s password can be changed using the password stored in memory. Although the UI requires the user to authenticate with the current password at an earlier stage of the flow, if an attacker manipulates the state of the application, the password stored in memory could be used to change the wallet’s password.

Impact An attacker can extract the password from memory. The extracted password can be used with all changePassword functions to change the password, disabling the user from unlocking the wallet. Additionally, the attacker could use the extracted password to attempt authentication on other platforms, as users tend to use similar passwords across different platforms.

Refer to full audit report first - Issue I

https://allinbits.slack.com/archives/C02U9SVJT97/p1652107168347859

josietyleung commented 2 years ago

Issue moved to EmerisHQ/emeris-extension #128 via ZenHub