{"action":"created","issue":{"url":"https://api.github.com/repos/syncthing/syncthing/issues/3357","repository_url":"https://api.github.com/repos/syncthing/syncthing","labels_url":"https://api.github.com/repos/syncthing/syncthing/issues/3357/labels{/name}","comments_url":"https://api.github.com/repos/syncthing/syncthing/issues/3357/comments","events_url":"https://api.github.com/repos/syncthing/syncthing/issues/3357/events","html_url":"https://github.com/syncthing/syncthing/issues/3357","id":162446157,"number":3357,"title":"Insecure authentication for web GUI by default","user":{"login":"jgoerzen","id":112925,"avatar_url":"https://avatars.githubusercontent.com/u/112925?v=3","gravatar_id":"","url":"https://api.github.com/users/jgoerzen","html_url":"https://github.com/jgoerzen","followers_url":"https://api.github.com/users/jgoerzen/followers","following_url":"https://api.github.com/users/jgoerzen/following{/other_user}","gists_url":"https://api.github.com/users/jgoerzen/gists{/gist_id}","starred_url":"https://api.github.com/users/jgoerzen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgoerzen/subscriptions","organizations_url":"https://api.github.com/users/jgoerzen/orgs","repos_url":"https://api.github.com/users/jgoerzen/repos","events_url":"https://api.github.com/users/jgoerzen/events{/privacy}","received_events_url":"https://api.github.com/users/jgoerzen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-06-27T12:59:53Z","updated_at":"2016-06-27T15:28:12Z","closed_at":null,"body":"Hello,\r\n\r\nI initially discussed this with security@syncthing.net, and @calmh advised me to submit this here.\r\n\r\nThrough the \"GUI\" (web interface), an attacker could easily obtain all of the user's files by authorizing a new device ID into the sync.  All an attacker has to do is somehow connect to the port on localhost.\r\n\r\nAlthough syncthing supports setting a username/password for this, it is not done by default.\r\n\r\nUnfortunately, connecting to a port on localhost is quite simple in a lot of cases.  More and more systems are effectively multiuser today (not just Linux, but also think of Windows machines with multiple family members with accounts), and there are other ways to proxy a connection to localhost.\r\n\r\nThe simple solution to this would be to require (or at least very strongly encourage) the user to set a username/password if either the username or password are blank.\r\n\r\nFurthermore, if syncthing wanted to let the user bypass this prompt when the web GUI is started from the CLI or syncthing-gtk, it could pass along an auth token in the initial URL (git-annex does this).  I do not see this as all that critical, thoough.\r\n\r\n@calmh advised me that the API is already secured and that Syncthing does have protections for XSS in the web GUI, which narrows but does not eliminate the attack surface.\r\n\r\nCurrent behavior as of 0.13.9."},"comment":{"url":"https://api.github.com/repos/syncthing/syncthing/issues/comments/228780781","html_url":"https://github.com/syncthing/syncthing/issues/3357#issuecomment-228780781","issue_url":"https://api.github.com/repos/syncthing/syncthing/issues/3357","id":228780781,"user":{"login":"jgoerzen","id":112925,"avatar_url":"https://avatars.githubusercontent.com/u/112925?v=3","gravatar_id":"","url":"https://api.github.com/users/jgoerzen","html_url":"https://github.com/jgoerzen","followers_url":"https://api.github.com/users/jgoerzen/followers","following_url":"https://api.github.com/users/jgoerzen/following{/other_user}","gists_url":"https://api.github.com/users/jgoerzen/gists{/gist_id}","starred_url":"https://api.github.com/users/jgoerzen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgoerzen/subscriptions","organizations_url":"https://api.github.com/users/jgoerzen/orgs","repos_url":"https://api.github.com/users/jgoerzen/repos","events_url":"https://api.github.com/users/jgoerzen/events{/privacy}","received_events_url":"https://api.github.com/users/jgoerzen/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T15:28:12Z","updated_at":"2016-06-27T15:28:12Z","body":"Here are some examples.\n\nJava - I have a home automation system controlled via a JavaWS app.  I\nhave to click accept the first time, but then it can make arbitrary\nnetwork socket connections.  So very many users do not understand the\nimplications of things and just click Accept all the time.  I would\nconsider Java apps a viable attack vector.\n\nMultiple user accounts - the untrusted account is more common than you\nmight think.  For instance, families might set up limited accounts for\nchildren that might have proxied Internet or keep them out of the\nparents' private files.  People that do this are unlikely to understand\nthe implications of connecting to a Syncthing web UI at localhost.\n\nIn fact, a great many people are unlikely to think of the implications\nof that.  Even ssh.  For instance, consider someone that wanted to grant\nsomeone else the ability to run a supposedly-secure and locked-down\ncommand on their machine, but didn't know to add no-port-forwarding to\ntheir authorized_keys file.\n\nBasically what I'm saying is this is a real threat, and our battle\nsecurity-wise is to make things as hard as possible for attackers.  This\njust makes it easier for attackers.\n"}}
{"actor":{"display_login":"jgoerzen"}}