search

nus-cs2113-AY2425S1 / pe-dev-response

0 stars 0 forks source link

Password encoding in the password file is easily exploitable by changing the value in password file to 0. #628

Open nus-pe-bot opened 1 week ago

nus-pe-bot commented 1 week ago

Details: While the mechanism behind the password is kept secret from the user (see Screenshot 1), it is easily exploitable due to the 2 following reasons:

  1. Anyone is able to modify the password file
  2. The number 0 in the password file represents the empty password field (see Screenshot 2). Hence any malicious party is able to change the existing password in the file to 0, and then enter the application by just pressing enter when asked for the password. This means that the password set by the user essentially is useless since anyone can modify the file and change it to 0. This poses a major security risk to the user, and is a major flaw in the password system of the application.

Steps to Reproduce:

  1. Launch the app for the first time
  2. Set a proper password (such as P@ssw0rd12345)
  3. Finish setting up the budget limits
  4. Close the app
  5. Open the password file, delete the existing number, and write a 0 in it (like in Screenshot 2)
  6. Save and close the password file
  7. Re-launch the app

Expected: Change in password to be empty is detected and appropriate measures are taken

Actual: New password is set to be empty, which means just pressing enter when the password is asked lets the user in.

Screenshot: 1. image.png

  1. image.png

[original: nus-cs2113-AY2425S1/pe-interim#429] [original labels: severity.Medium type.FunctionalityBug]

NigelYeoTW commented 1 week ago

Team's Response

Dear tester,

The team has discussed and decided to categorize this bug as not in scope and downgraded it to severity of low. The following are the justifications:

  1. The course has specified that the data files are protected by default on the course website as seen below.

image.png

  1. Password files stored locally is bound to face some sort of security issues. Due to the constraint of this project, we are unable to implement this more securely and thus the issue is posted to the future after v2.1.

  2. We feel that this would be a very rare occurrence to users as well.

Duplicate status (if any):

--