{"action":"created","issue":{"url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/766","repository_url":"https://api.github.com/repos/dgibbs64/linuxgsm","labels_url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/766/labels{/name}","comments_url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/766/comments","events_url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/766/events","html_url":"https://github.com/dgibbs64/linuxgsm/issues/766","id":142972450,"number":766,"title":"Security: Rust server sends RCON password insecurely with e-mail","user":{"login":"Flightkick","id":8693699,"avatar_url":"https://avatars.githubusercontent.com/u/8693699?v=3","gravatar_id":"","url":"https://api.github.com/users/Flightkick","html_url":"https://github.com/Flightkick","followers_url":"https://api.github.com/users/Flightkick/followers","following_url":"https://api.github.com/users/Flightkick/following{/other_user}","gists_url":"https://api.github.com/users/Flightkick/gists{/gist_id}","starred_url":"https://api.github.com/users/Flightkick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Flightkick/subscriptions","organizations_url":"https://api.github.com/users/Flightkick/orgs","repos_url":"https://api.github.com/users/Flightkick/repos","events_url":"https://api.github.com/users/Flightkick/events{/privacy}","received_events_url":"https://api.github.com/users/Flightkick/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-23T14:21:03Z","updated_at":"2016-03-23T14:52:33Z","closed_at":null,"body":"`./rustserver test-email` sends the command line argumens along with the e-mail, this includes the RCON password.\r\n\r\nThis means an attacker could use a MITM attack and other methods to retrieve the password.\r\n\r\nSolution: Either don't send the command line arguments with the e-mails or replace the password by a mask.\r\n\r\nEDIT: Just checked the code and it seems to be more secure to remove the executable + args from the script. Also this issue is related to all email notifications for servers with an (RCON) password in the arguments, not only test e-mails and not only applicable to Rust."},"comment":{"url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/comments/200379111","html_url":"https://github.com/dgibbs64/linuxgsm/issues/766#issuecomment-200379111","issue_url":"https://api.github.com/repos/dgibbs64/linuxgsm/issues/766","id":200379111,"user":{"login":"UltimateByte","id":8805941,"avatar_url":"https://avatars.githubusercontent.com/u/8805941?v=3","gravatar_id":"","url":"https://api.github.com/users/UltimateByte","html_url":"https://github.com/UltimateByte","followers_url":"https://api.github.com/users/UltimateByte/followers","following_url":"https://api.github.com/users/UltimateByte/following{/other_user}","gists_url":"https://api.github.com/users/UltimateByte/gists{/gist_id}","starred_url":"https://api.github.com/users/UltimateByte/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/UltimateByte/subscriptions","organizations_url":"https://api.github.com/users/UltimateByte/orgs","repos_url":"https://api.github.com/users/UltimateByte/repos","events_url":"https://api.github.com/users/UltimateByte/events{/privacy}","received_events_url":"https://api.github.com/users/UltimateByte/received_events","type":"User","site_admin":false},"created_at":"2016-03-23T14:52:33Z","updated_at":"2016-03-23T14:52:33Z","body":"You're right, thanks :)"}}