3 ms·
tl;dr: this app is supposed to be used only for governmental staff. It does so by checking if you have a @elysee.fr or a @gouv.fr email. He bypassed the check b
by Iv 7y ago
tl;dr: this app is supposed to be used only for governmental staff. It does so by checking if you have a @elysee.fr or a @gouv.fr email. He bypassed the check by using myadress@protonmail@presidence@elysee.fr. He could access the "public" groups normally reserved for employees.
The hole has been plugged.
- Arathorn 7y agoYup, there was a single bug here (which I wrote; serves me right for blindly trusting a mail addr parsing library), which boils down to: $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com')" ('', 'bob@evil.com') $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com@gouv.fr')" ('', 'bob@evil.com') We deployed a fix within about 90 mins of being alerted, and also released an security update for anyone else who is in the same situation (which is very unlikely): https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/ https://matrix.org/blog/2019/04/18/security-update-sydent-1-...
- Iv 7y agoI am not a webdev so I may be totally out of the loop here but when I was still in engineering school I was told to never trust a user just because of their email because it can easily be spoofed. It is not the case anymore? And also I am a bit surprised that government employees don't have a way to authenticate themselves? I thought at least the president and several military staff already had secure phone that used the (kinda unluckily named) Isis network?
- Arathorn 7y agothe way the auth works is to send an email to the gouv.fr address to get the user to click a verification link. this should be fairly trustworthy (ignoring the bug here where verification mail got sent to the attacker’s address :|)