search

NebulousLabs / docker-sia

The official docker image for the Sia daemon
https://sia.tech
MIT License
20 stars 1 forks source link

Security issue with SIA_API_PASSWORD #1

Closed max-was-here closed 4 years ago

max-was-here commented 4 years ago

There is a big issue in regards to how the SIA_API_PASSWORD environment variable is set in the current Docker image.

By setting ARG SIA_API_PASSWORD="/root/.sia" you are setting the password to "/root/.sia" not the path.

You can validate it by executing the following commands on a new docker data folder : 

mkdir sia-data

docker run \
   --detach \
   --volume $(pwd)/sia-data:/sia-data \
   --publish 127.0.0.1:9980:9980 \
   --publish 9981:9981 \
   --publish 9982:9982 \
   --name sia-container \
    nebulouslabs/sia

curl -A "Sia-Agent" -u "":"/root/.sia" --data "encryptionpassword=test&force=false" "127.0.0.1:9980/wallet/init"

curl -A "Sia-Agent" -u "":"/root/.sia" --data "encryptionpassword=test" "127.0.0.1:9980/wallet/unlock"

curl -A "Sia-Agent" -u "":"/root/.sia" "127.0.0.1:9980/wallet/address"