{"action":"created","issue":{"url":"https://api.github.com/repos/pfn/keepasshttp/issues/258","labels_url":"https://api.github.com/repos/pfn/keepasshttp/issues/258/labels{/name}","comments_url":"https://api.github.com/repos/pfn/keepasshttp/issues/258/comments","events_url":"https://api.github.com/repos/pfn/keepasshttp/issues/258/events","html_url":"https://github.com/pfn/keepasshttp/issues/258","id":129647436,"number":258,"title":"Security problem for remote users","user":{"login":"Quiark","id":59075,"avatar_url":"https://avatars.githubusercontent.com/u/59075?v=3","gravatar_id":"","url":"https://api.github.com/users/Quiark","html_url":"https://github.com/Quiark","followers_url":"https://api.github.com/users/Quiark/followers","following_url":"https://api.github.com/users/Quiark/following{/other_user}","gists_url":"https://api.github.com/users/Quiark/gists{/gist_id}","starred_url":"https://api.github.com/users/Quiark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Quiark/subscriptions","organizations_url":"https://api.github.com/users/Quiark/orgs","repos_url":"https://api.github.com/users/Quiark/repos","events_url":"https://api.github.com/users/Quiark/events{/privacy}","received_events_url":"https://api.github.com/users/Quiark/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-29T02:40:24Z","updated_at":"2016-02-01T17:10:17Z","closed_at":null,"body":"Hi, \r\ncan't get the author's email but there's a security issue affecting users who allow remote connections to KeePassHttp.\r\n\r\n@pfn, please contact me at me@rplasil.name for details.\r\n\r\nFor users: make sure you don't enable remote connections to the plugin. In Options - Advanced - Host, it should be `localhost`"},"comment":{"url":"https://api.github.com/repos/pfn/keepasshttp/issues/comments/178072771","html_url":"https://github.com/pfn/keepasshttp/issues/258#issuecomment-178072771","issue_url":"https://api.github.com/repos/pfn/keepasshttp/issues/258","id":178072771,"user":{"login":"pfn","id":512197,"avatar_url":"https://avatars.githubusercontent.com/u/512197?v=3","gravatar_id":"","url":"https://api.github.com/users/pfn","html_url":"https://github.com/pfn","followers_url":"https://api.github.com/users/pfn/followers","following_url":"https://api.github.com/users/pfn/following{/other_user}","gists_url":"https://api.github.com/users/pfn/gists{/gist_id}","starred_url":"https://api.github.com/users/pfn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pfn/subscriptions","organizations_url":"https://api.github.com/users/pfn/orgs","repos_url":"https://api.github.com/users/pfn/repos","events_url":"https://api.github.com/users/pfn/events{/privacy}","received_events_url":"https://api.github.com/users/pfn/received_events","type":"User","site_admin":false},"created_at":"2016-02-01T17:10:17Z","updated_at":"2016-02-01T17:10:17Z","body":"TLS will never be implemented for the plugin.\n\nOn Mon, Feb 1, 2016 at 7:16 AM Roman Plášil <notifications@github.com>\nwrote:\n\n> I was looking into starting to use KeePass as the password manager and\n> first thing I searched for was browser integration. I think KeePassHttp is\n> a very useful tool but when I looked deeper I found some issues.\n> Description\n>\n> The communication between KeePass and the browser plugin is encrypted\n> using AES 256. The implementation in KeepassHttp is not secure though.\n> Attackers who are able to capture this encrypted traffic and send requests\n> to the server can manage to decrypt captured passwords. Users who don't\n> enable any remote connection and only stay on localhost for both client and\n> server should be fine, others could be in trouble.\n>\n> The fundamental problem is that the integrity of the encrypted entries is\n> not protected using an authenticated MAC, authenticated encryption mode or\n> a signature. This allows for the *CBC padding oracle attack* to be\n> executed remotely to decrypt any encrypted entry that was captured earlier.\n>\n> Leaking entire passwords to remote attackers is of course a serious\n> problem but its impact is limited by the default setting to not allow\n> remote connections. Furthermore, the padding oracle attack requires a few\n> thousands requests to be executed, each of which pops an error tooltip on\n> the targeted user's desktop. This doesn't mean that the user is protected\n> though, a coworker could execute this attack when the target is away from\n> the computer for example.\n>\n> Leaving this particular vulnerability aside, the project's GitHub\n> description says that KeepassHttp exposes password entries securely. I\n> think most users, especially as the project reaches a wider user base, will\n> just take that for granted and not pay attention to the caveat that the\n> first key exchange is totally unprotected.\n>\n> CBC padding oracle attack:\n>\n>    - http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/\n>    - http://robertheaton.com/2013/07/29/padding-oracle-attack/\n>    - http://cryptopals.com/sets/3/challenges/17/\n>\n> Cryptographic best practices:\n>\n>    - https://gist.github.com/tqbf/be58d2d39690c3b366ad\n>\n> Suggested fix\n>\n> *Short-term mitigation:* An update for KeepassHttp that disables remote\n> access completely or at least strongly warns users about this danger.\n> Direct users in how to securely perform the association (with a\n> disconnected computer).\n>\n> *Proper fix:* Use cryptography best practices or, even better, use a TLS\n> connection with self-generated certificates that the user confirms on both\n> ends. Cryptography best practices in this case would be:\n>\n>    - each encrypted item must be also verified for authenticity using\n>    keyed HMAC, AES-GCM or a digital signature\n>    - any errors inside the server handlers should not be detailed in the\n>    response. Just return a generic 503 message\n>    - watch out for timing attacks that can give out the same information\n>    as error messages\n>    - the Verifier field is completely useless because attacker can reuse\n>    the one that she captured earlier\n>    - ideally the entire message should be encrypted with authentication,\n>    not only some fields\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/pfn/keepasshttp/issues/258#issuecomment-178012219>.\n>\n"}}