{"action":"created","issue":{"url":"https://api.github.com/repos/directus/api/issues/986","repository_url":"https://api.github.com/repos/directus/api","labels_url":"https://api.github.com/repos/directus/api/issues/986/labels{/name}","comments_url":"https://api.github.com/repos/directus/api/issues/986/comments","events_url":"https://api.github.com/repos/directus/api/issues/986/events","html_url":"https://github.com/directus/api/issues/986","id":449477308,"node_id":"MDU6SXNzdWU0NDk0NzczMDg=","number":986,"title":"[SECURITY] Static Links to uploaded files","user":{"login":"ybelenko","id":5541023,"node_id":"MDQ6VXNlcjU1NDEwMjM=","avatar_url":"https://avatars0.githubusercontent.com/u/5541023?v=4","gravatar_id":"","url":"https://api.github.com/users/ybelenko","html_url":"https://github.com/ybelenko","followers_url":"https://api.github.com/users/ybelenko/followers","following_url":"https://api.github.com/users/ybelenko/following{/other_user}","gists_url":"https://api.github.com/users/ybelenko/gists{/gist_id}","starred_url":"https://api.github.com/users/ybelenko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ybelenko/subscriptions","organizations_url":"https://api.github.com/users/ybelenko/orgs","repos_url":"https://api.github.com/users/ybelenko/repos","events_url":"https://api.github.com/users/ybelenko/events{/privacy}","received_events_url":"https://api.github.com/users/ybelenko/received_events","type":"User","site_admin":false},"labels":[{"id":838688385,"node_id":"MDU6TGFiZWw4Mzg2ODgzODU=","url":"https://api.github.com/repos/directus/api/labels/bug","name":"bug","color":"c62828","default":true},{"id":838688386,"node_id":"MDU6TGFiZWw4Mzg2ODgzODY=","url":"https://api.github.com/repos/directus/api/labels/duplicate","name":"duplicate","color":"CFD8DC","default":true},{"id":838688387,"node_id":"MDU6TGFiZWw4Mzg2ODgzODc=","url":"https://api.github.com/repos/directus/api/labels/enhancement","name":"enhancement","color":"B3E5FC","default":true},{"id":838688391,"node_id":"MDU6TGFiZWw4Mzg2ODgzOTE=","url":"https://api.github.com/repos/directus/api/labels/question","name":"question","color":"F5F5F5","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2019-05-28T21:05:53Z","updated_at":"2019-06-26T13:49:05Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"# Feature Request\r\n\r\nAbout audited Directus version. \r\nIt has been cloned from suite repo.\r\nLatest commit https://github.com/directus/directus/commit/1d151a9034514e3f2ec1c80001e7c5fffdef2d4e\r\n\r\n## Description:\r\n\r\nIn Internet systems, there is sometimes a file upload mechanism, which allowing the user to upload files to share information between entities that communicate through the application. Files upload mechanism often generate direct links to download the uploaded files from the system. These mechanisms sometimes choose a name of file and store the uploaded file according to the name the chosen on the web server. A mechanism that defines file names in a sequence numbers is an insecure mechanism because it allows guessing of uploaded files more easily, thus allowing access to sensitive personal information.\r\n\r\n## Business risk:\r\n\r\nAfter exploiting this vulnerability, an attacker can easily guess links to uploaded files.\r\n\r\n## Technical details:\r\n\r\nDuring the test, it was found that the application’s upload files mechanism generates static links to uploaded files, thing that allows an attacker to get access to uploaded files that were uploaded into the system, even if were uploaded by other users.\r\n\r\n![screenshot](https://s3.eu-central-1.amazonaws.com/directus-security-report/4.0.2.jpg)\r\n\r\n## What problem does this feature solve?\r\nFixes security hole.\r\n\r\n## How do you think this should be implemented?\r\n* Do not let users to get access to upload files that were uploaded by another users.\r\n* Image ID should be chosen by unpredictable way and one-time random token should be appended to the\r\nlink in order to prevent exact link guessing.\r\n* Implement an authorization mechanism that validate if user authorized to view or download the specific file.\r\n\r\n## Would you be willing to work on this?\r\nMaybe, with help/guidance from Directus team."},"comment":{"url":"https://api.github.com/repos/directus/api/issues/comments/505883311","html_url":"https://github.com/directus/api/issues/986#issuecomment-505883311","issue_url":"https://api.github.com/repos/directus/api/issues/986","id":505883311,"node_id":"MDEyOklzc3VlQ29tbWVudDUwNTg4MzMxMQ==","user":{"login":"rijkvanzanten","id":9141017,"node_id":"MDQ6VXNlcjkxNDEwMTc=","avatar_url":"https://avatars3.githubusercontent.com/u/9141017?v=4","gravatar_id":"","url":"https://api.github.com/users/rijkvanzanten","html_url":"https://github.com/rijkvanzanten","followers_url":"https://api.github.com/users/rijkvanzanten/followers","following_url":"https://api.github.com/users/rijkvanzanten/following{/other_user}","gists_url":"https://api.github.com/users/rijkvanzanten/gists{/gist_id}","starred_url":"https://api.github.com/users/rijkvanzanten/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rijkvanzanten/subscriptions","organizations_url":"https://api.github.com/users/rijkvanzanten/orgs","repos_url":"https://api.github.com/users/rijkvanzanten/repos","events_url":"https://api.github.com/users/rijkvanzanten/events{/privacy}","received_events_url":"https://api.github.com/users/rijkvanzanten/received_events","type":"User","site_admin":false},"created_at":"2019-06-26T13:49:05Z","updated_at":"2019-06-26T13:49:05Z","author_association":"MEMBER","body":"We need to pay attention to the subtle difference between this and #987 though. This issue states\r\n\r\n> During the test, it was found that the application’s upload files mechanism **generates static links to uploaded files**, thing that allows an attacker to get access to uploaded files that were uploaded into the system, even if were uploaded by other users.\r\n\r\nBy using UUIDs, this _will not_ be fixed, as it's still a public static link. \r\n\r\nThe business risk will be fixed though:\r\n\r\n> After exploiting this vulnerability, an attacker can easily guess links to uploaded files.\r\n\r\nAs the UUID is way harder / impossible to guess. That being said, a UUID _is not_ a hash or any other cryptographically secure method of generating file names, so one could theoretically work out the UUID structure and programmatically \"guess\" filenames.\r\n\r\n@bjgajjar "}}
{"actor":{"display_login":"rijkvanzanten"}}