{"action":"created","issue":{"url":"https://api.github.com/repos/cryptomator/cryptomator/issues/318","repository_url":"https://api.github.com/repos/cryptomator/cryptomator","labels_url":"https://api.github.com/repos/cryptomator/cryptomator/issues/318/labels{/name}","comments_url":"https://api.github.com/repos/cryptomator/cryptomator/issues/318/comments","events_url":"https://api.github.com/repos/cryptomator/cryptomator/issues/318/events","html_url":"https://github.com/cryptomator/cryptomator/issues/318","id":170185336,"number":318,"title":"Security issue: Cross Site Content Hijacking","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-09T14:46:42Z","updated_at":"2016-08-09T15:06:11Z","closed_at":null,"body":"**Description:**\r\n\r\nSince the response headers when downloading files are not set to secure values an attacker can perform Cross Site Content Hijacking to extract arbitrary data from a Cryptomator installation. Some more information including a demo on that can be found at https://github.com/nccgroup/CrossSiteContentHijacking\r\n\r\nThis attack requires that an attacker can upload arbitrary files on their own. Due to the vulnerability pointed out in #319, this is however possible. An attacker basically would just have to upload such a file using CSRF and then can start extracting data. \r\n\r\nPerforming a PROPFIND to extract the file list is left as exercise to the reader 😉 – I won't share completely weaponized exploits here.\r\n\r\n**Recommendation:**\r\n\r\nServe all files with a harmless Content-Disposition of for example `application/octet-stream `and add the nosniff header.\r\n\r\n-------\r\n*Disclaimer: Normally, I wouldn't report security issues like that in the public. [But I was asked by the Cryptomator authors on Twitter to do so.](https://twitter.com/Cryptomator/status/762995023457742848)*"},"comment":{"url":"https://api.github.com/repos/cryptomator/cryptomator/issues/comments/238583151","html_url":"https://github.com/cryptomator/cryptomator/issues/318#issuecomment-238583151","issue_url":"https://api.github.com/repos/cryptomator/cryptomator/issues/318","id":238583151,"user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"created_at":"2016-08-09T15:06:11Z","updated_at":"2016-08-09T15:06:11Z","body":"Would certainly mitigate the problem best, but I'm wondering what's the UX impact on this. I guess having the credentials static for each mount would be \"good enough\" and doesn't require one to re-setup the mount all the time."}}
{"actor":{"display_login":"LukasReschke"}}