{"action":"created","issue":{"url":"https://api.github.com/repos/nuxsmin/sysPass/issues/310","repository_url":"https://api.github.com/repos/nuxsmin/sysPass","labels_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/310/labels{/name}","comments_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/310/comments","events_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/310/events","html_url":"https://github.com/nuxsmin/sysPass/pull/310","id":184030373,"node_id":"MDExOlB1bGxSZXF1ZXN0OTAwNTg2OTU=","number":310,"title":"Add API Request Signature","user":{"login":"t3hchipmunk","id":11212165,"node_id":"MDQ6VXNlcjExMjEyMTY1","avatar_url":"https://avatars1.githubusercontent.com/u/11212165?v=4","gravatar_id":"","url":"https://api.github.com/users/t3hchipmunk","html_url":"https://github.com/t3hchipmunk","followers_url":"https://api.github.com/users/t3hchipmunk/followers","following_url":"https://api.github.com/users/t3hchipmunk/following{/other_user}","gists_url":"https://api.github.com/users/t3hchipmunk/gists{/gist_id}","starred_url":"https://api.github.com/users/t3hchipmunk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t3hchipmunk/subscriptions","organizations_url":"https://api.github.com/users/t3hchipmunk/orgs","repos_url":"https://api.github.com/users/t3hchipmunk/repos","events_url":"https://api.github.com/users/t3hchipmunk/events{/privacy}","received_events_url":"https://api.github.com/users/t3hchipmunk/received_events","type":"User","site_admin":false},"labels":[{"id":119336338,"node_id":"MDU6TGFiZWwxMTkzMzYzMzg=","url":"https://api.github.com/repos/nuxsmin/sysPass/labels/FR-Analyze","name":"FR-Analyze","color":"0e8a16","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-10-19T17:50:33Z","updated_at":"2019-01-03T08:57:41Z","closed_at":"2019-01-03T08:57:41Z","author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/nuxsmin/sysPass/pulls/310","html_url":"https://github.com/nuxsmin/sysPass/pull/310","diff_url":"https://github.com/nuxsmin/sysPass/pull/310.diff","patch_url":"https://github.com/nuxsmin/sysPass/pull/310.patch"},"body":"Currently, there seems to be an open vulnerability when using the API functionality. A valid request involves a token and password being sent in the URL of the request. This request URL does not expire or invalidate, meaning that if someone were to get the URL they can replay the attack indefinitely by changing a few parameters.\n\nTo fix this I propose adding two pieces of functionality. First, a token is used only to identify the user. Second, a shared secret is added to the token functionality. Third, a request timestamp is added.\n\nA normal request would be:\nhttps://www.example.info/sysPass/api.php?t=063c8cc5798b7241052aef1ee85690fd09885aad&a=3&i=2&up=MYSUPERSECRETPASSWORD\n\nI propose it would function more like so:\nAssume my shared secret is SUPERSHAREDSECRET\n\nFirst, a request message is created as such:\n<method>&[<sorted key, value parameters>]\nGET&a=3&i=2&t=063c8cc5798b7241052aef1ee85690fd09885aad&rt=1476898952\n\nI then run that through a SHA-256 HMAC and hex-encode the result. This equals:\n17adf85c2c47238b3c922a22cd6a262369db6f5796cc1fa8212b26ff82bbc537\n\nI then setup my request like so:\nhttps://www.example.info/sysPass/api.php?a=3&i=2&t=063c8cc5798b7241052aef1ee85690fd09885aad&rt=1476898952&rs=17adf85c2c47238b3c922a22cd6a262369db6f5796cc1fa8212b26ff82bbc537\n\nThe server receives the request. Pulls the shared secret from the database. Recreates the first step, signs it, and compares the signature. If the signature matches, it moves forward, if not, then it throws an exception. Additionally, the timestamp (defined in rt) is checked to ensure that it falls within a certain time-frame, in the case of my changes 5 minutes on either side, totaling 10 minutes. This can be changed to a smaller timeframe, say a few seconds or so, to prevent a replay attack window.\n\nThis is my first pull request, so hopefully I did OK explaining the situation and what it would fix.\n"},"comment":{"url":"https://api.github.com/repos/nuxsmin/sysPass/issues/comments/451085087","html_url":"https://github.com/nuxsmin/sysPass/pull/310#issuecomment-451085087","issue_url":"https://api.github.com/repos/nuxsmin/sysPass/issues/310","id":451085087,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MTA4NTA4Nw==","user":{"login":"nuxsmin","id":1775774,"node_id":"MDQ6VXNlcjE3NzU3NzQ=","avatar_url":"https://avatars1.githubusercontent.com/u/1775774?v=4","gravatar_id":"","url":"https://api.github.com/users/nuxsmin","html_url":"https://github.com/nuxsmin","followers_url":"https://api.github.com/users/nuxsmin/followers","following_url":"https://api.github.com/users/nuxsmin/following{/other_user}","gists_url":"https://api.github.com/users/nuxsmin/gists{/gist_id}","starred_url":"https://api.github.com/users/nuxsmin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nuxsmin/subscriptions","organizations_url":"https://api.github.com/users/nuxsmin/orgs","repos_url":"https://api.github.com/users/nuxsmin/repos","events_url":"https://api.github.com/users/nuxsmin/events{/privacy}","received_events_url":"https://api.github.com/users/nuxsmin/received_events","type":"User","site_admin":false},"created_at":"2019-01-03T08:57:41Z","updated_at":"2019-01-03T08:57:41Z","author_association":"OWNER","body":"Hello, sysPass v3 has been released out and many features besides bugfixes have been implemented/solved.\r\n\r\nThanks for your contribution!"}}
{"actor":{"display_login":"nuxsmin"}}