5 ms·

It wasn't mean to be client-side only, it was meant to be client-side and server-side. Unfortunately, the server-side check wasn't happening in the way intended

It wasn't mean to be client-side only, it was meant to be client-side and server-side. Unfortunately, the server-side check wasn't happening in the way intended allowing Albert to find this vulnerability. We have a special document that describes bug classes that need special attention and this particular incident has been added to it.

OJFord 4y ago
I think you're giving too much weight to this angle - if OP had happened to be in the beta, that part wouldn't have been found or mentioned at all. Bypassing a beta feature toggle isn't really a vulnerability IMO, it just allowed OP to find one in this case.
- mox1 4y ago
  What!? So nobody here can think of any possible scenario where bypassing a server-side check for 'Account X can access Feature Y' could directly lead to a security issue? This is absolutely 100% a vulnerability - insomuch as that CloudFlare should have an explicit policy that ALL account features are enabled / verified server-side, not client side. Think of all the spam that would have happened, had this been discovered on underground black-hat forums.
  - OJFord 4y ago
    Do you want to offer some? It's not clear this even bypassed payment that should have been due. That would be worse, and still not really a vulnerability. > Think of all the spam that would have happened, had this been discovered on underground black-hat forums. What spam would have happened as a result of early access to a new Cloudflare feature, that's independent of any (other) bugs/security flaws in that feature? (Also, even with the actual vulnerability here, what 'spam' would have happened? This hijacks recieving. Worse, yes, but I don't see how it helps spammers.)
    - BeefWellington 4y ago
      Accessing functionality you should not otherwise have access to is by definition a vulnerability. CF apparently agrees since they paid out a bounty for it.
      - OJFord 4y ago
        > CF apparently agrees since they paid out a bounty for it. Not really, it was mentioned as part of a report of the main, much more critical issue of 'hijacking email with Cloudflare Email Routing' - note that's the title itself, not 'accessing a cloudflare beta feature'...
- systemvoltage 4y ago
  jgc is just responding to the OP, don't strawman him. OP is the person focusing on the client-side beta check, so jgc is responding to that particular thing. Has zero bearing on the overall issue.
  - OJFord 4y ago
    I'm not 'strawmanning' him, I'm saying responding to that line of argument (or at least in the way that he did, accepting the claim it's bad and defending on the back foot) lends it undeserved credence. I agree it 'has zero bearing on the overall issue'. That is pretty much my entire point.
js2 4y ago
How was this feature able to ship to production w/o the server-side check being tested? Does CF have a launch process for new features? Does that process include reviewing the special document and testing the new feature against the various bug classes?
ffhhj 4y ago
》We have a special document that describes bug classes that need special attention Sounds like manual testing that should be automated.
btown 4y ago
It occurs to me that this speaks to a more fundamental pain point in software testing. It's so common to write tests that say, in one block of code, "these are the inputs, a function or endpoint is called, and these are the expected outputs." But in theory, every single one of those tests should have variations like "if this exact same input was provided, but with a user with different permissions, as well as a non-logged-in user, the endpoint should fail with a permission error." But then you get into a quandary: if you want to be able to customize your test code granularly, or have your inputs and outputs generated at runtime, you need to be able to write your test setup code as code, not [{ input, endpoint_name, output }] configurations. But if you need code, then you can accidentally run code that calls things directly without the abstractions that would run it with the extra variations. At a certain scale, this speaks to needing either static analysis of your testing code, or extremely diligent review processes, beyond simple code coverage. Does anyone have go-to libraries that deal with this at scale?

OJFord 4y ago

I think you're giving too much weight to this angle - if OP had happened to be in the beta, that part wouldn't have been found or mentioned at all. Bypassing a beta feature toggle isn't really a vulnerability IMO, it just allowed OP to find one in this case.

mox1 4y ago
What!? So nobody here can think of any possible scenario where bypassing a server-side check for 'Account X can access Feature Y' could directly lead to a security issue? This is absolutely 100% a vulnerability - insomuch as that CloudFlare should have an explicit policy that ALL account features are enabled / verified server-side, not client side. Think of all the spam that would have happened, had this been discovered on underground black-hat forums.
- OJFord 4y ago
  Do you want to offer some? It's not clear this even bypassed payment that should have been due. That would be worse, and still not really a vulnerability. > Think of all the spam that would have happened, had this been discovered on underground black-hat forums. What spam would have happened as a result of early access to a new Cloudflare feature, that's independent of any (other) bugs/security flaws in that feature? (Also, even with the actual vulnerability here, what 'spam' would have happened? This hijacks recieving. Worse, yes, but I don't see how it helps spammers.)
  - BeefWellington 4y ago
    Accessing functionality you should not otherwise have access to is by definition a vulnerability. CF apparently agrees since they paid out a bounty for it.
    - OJFord 4y ago
      > CF apparently agrees since they paid out a bounty for it. Not really, it was mentioned as part of a report of the main, much more critical issue of 'hijacking email with Cloudflare Email Routing' - note that's the title itself, not 'accessing a cloudflare beta feature'...
systemvoltage 4y ago
jgc is just responding to the OP, don't strawman him. OP is the person focusing on the client-side beta check, so jgc is responding to that particular thing. Has zero bearing on the overall issue.
- OJFord 4y ago
  I'm not 'strawmanning' him, I'm saying responding to that line of argument (or at least in the way that he did, accepting the claim it's bad and defending on the back foot) lends it undeserved credence. I agree it 'has zero bearing on the overall issue'. That is pretty much my entire point.

js2 4y ago

How was this feature able to ship to production w/o the server-side check being tested? Does CF have a launch process for new features? Does that process include reviewing the special document and testing the new feature against the various bug classes?

ffhhj 4y ago

》We have a special document that describes bug classes that need special attention Sounds like manual testing that should be automated.

btown 4y ago

It occurs to me that this speaks to a more fundamental pain point in software testing. It's so common to write tests that say, in one block of code, "these are the inputs, a function or endpoint is called, and these are the expected outputs." But in theory, every single one of those tests should have variations like "if this exact same input was provided, but with a user with different permissions, as well as a non-logged-in user, the endpoint should fail with a permission error." But then you get into a quandary: if you want to be able to customize your test code granularly, or have your inputs and outputs generated at runtime, you need to be able to write your test setup code as code, not [{ input, endpoint_name, output }] configurations. But if you need code, then you can accidentally run code that calls things directly without the abstractions that would run it with the extra variations. At a certain scale, this speaks to needing either static analysis of your testing code, or extremely diligent review processes, beyond simple code coverage. Does anyone have go-to libraries that deal with this at scale?