search

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
https://sandstorm.io
Other
6.69k stars 708 forks source link

Preventing access to client local network? #3711

Open xet7 opened 4 months ago

xet7 commented 4 months ago

Any comments to this?

https://forums.meteor.com/t/security-preventing-access-to-local-network/61237

ocdtrekkie commented 4 months ago

This is one of the things that was pointed out in Sandstorm's security review, and you'll notice Kenton added a tab in the admin panel which is populated with the internal network addresses to block.

ocdtrekkie commented 4 months ago

Oh the client-side local network. Interesting. I think our newer client-side sandboxing, if enabled, would cover this case?

xet7 commented 4 months ago

Is somewhere more info about client-side sandboxing?

ocdtrekkie commented 4 months ago

Mind you, even if one blocked an iframe from automatically executing this, presumably one could have a plain link which opens in a new tab... then you'd just need to trick someone into clicking on it, which is not particularly hard.

xet7 commented 4 months ago

Qubes OS has per-VM firewall rules that could be used to limit access to local network, I think. I'm just thinking, are there some other ways too.

xet7 commented 4 months ago

For client browser limiting access to filesystem, there is Firejail https://firejail.wordpress.com that works with Firefox, like only allowing access to Downloads directory. It works at Linux. I did not yet got it working with Chromium based browsers.

xet7 commented 4 months ago

Actually, Firejail has also some possibilities to limit network access, I think.

ocdtrekkie commented 4 months ago

https://docs.sandstorm.io/en/latest/administering/config-file/ defines the config flag you can switch. With the new CSP, the only remote resources you can load are image files, IIRC, so I think that would stop one from loading an iframe containing an external page.

Honestly I kinda think the old security policy might prevent it too, but I'm not positive.

Again, I think tricking someone into clicking a link is an easy way around it anyways, and might be something that the browser indeed may want to defend against. (Also default passwords are going out of style... slowly, but many new network devices ship with unique default passwords per unit.)