Require server-side authorization for destination and deletion #201
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Severity
Critical
Description
The receive root and destructive manifest operation are controlled by peer-supplied protocol/config data. Plain TCP has no authentication, TLS client authentication is optional, and manifest processing can invoke delete_extras without a server-side deletion policy. A client can therefore select an administrator-unintended destination or delete existing files beneath it.
Location
Validation
Send a valid configuration with an attacker-selected receive_root_directory, or send a manifest with count 0 followed by STATUS_FINISHED to a server with files under the selected root. Also test TLS with a configured CA but no client certificate.
Suggested implementation
Configure receive roots server-side, canonicalize and enforce an administrator-owned root, require authenticated/authorized peers for writes, gate deletion on server policy, and require SSL_VERIFY_FAIL_IF_NO_PEER_CERT when mutual TLS is configured. Add negative integration tests.