search

Symbiota / Symbiota-deprecated

This original code fork is considered deprecated and no longer maintained by the community. We recommend that you use one of the several actively developed forks.
GNU General Public License v2.0
23 stars 93 forks source link

Security issue with cookies #96

Closed dshorthouse closed 7 years ago

dshorthouse commented 7 years ago

https://github.com/Symbiota/Symbiota/blob/master/config/symbbase.php#L53 makes reference to global $_COOKIE items SymbiotaBase & SymbiotaRights. Without much effort, one can spoof these with a cookie editor and gain access to pages and functions that ordinarily require authentication. I won't explain here how that can be done but can follow-up via email if you want specifics. What I suggest is that cookie values be encrypted prior to sending to the client then that hash be used to look-up a user. This is far from perfect but at the very least will minimize user spoofing & permission escalation through a bit of obfuscation.

egbot commented 7 years ago

Added encryption of SymbiotaBase and SymbiotaRights cookies. There has not been much hacker interest in collection data, but at least this makes it harder for some bored hacker to raise havoc. Authentication model still needs to be reworked.

dshorthouse commented 7 years ago

+1