Security flaws in an SSO plugin for Caddy

#1

Post by eurg » Tue, Sep 19, 2023, 8:56 AM UTC

Security flaws in an SSO plugin for Caddy
blog.trailofbits.com

Re: Security flaws in an SSO plugin for Caddy

#2

Post by e12e » Tue, Sep 19, 2023, 12:11 PM UTC

Nice that the post includes a timeline - but considering some of these issues (broken rng, brute force of otp) - it's deeply concerning that the issues won't be fixed?

> August 7, 2023: We reported our findings to the caddy-security plugin maintainers.

> August 23, 2023: The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities.

Re: Security flaws in an SSO plugin for Caddy

#3

Post by eurg » Tue, Sep 19, 2023, 2:04 PM UTC

e12e wrote: post #2

Nice that the post includes a timeline - but considering some of these issues (broken rng, brute force of otp) - it's deeply concerning that the issues won't be fixed? > August 7, 2023: We reported our findings to the caddy-security plugin maintainers. > August 23, 2023: The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities.

Both the bug list and the reaction to it are deeply concerning, if you are depending on this project - but I don't know how much real world use this code gets.

Shows that reviewing dependencies is not optional. Hundreds of stars on GitHub is not a helpful data point, even if my own monkey brain says otherwise.

Re: Security flaws in an SSO plugin for Caddy

#4

Post by mholt » Tue, Sep 26, 2023, 4:52 PM UTC

eurg wrote: post #3

e12e wrote: post #2

Nice that the post includes a timeline - but considering some of these issues (broken rng, brute force of otp) - it's deeply concerning that the issues won't be fixed? > August 7, 2023: We reported our findings to the caddy-security plugin maintainers. > August 23, 2023: The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities.

Both the bug list and the reaction to it are deeply concerning, if you are depending on this project - but I don't know how much real world use this code gets. Shows that reviewing dependencies is not optional. Hundreds of stars on GitHub is not a helpful data point, even if my own monkey brain says otherwise.

Paul is a bit burnt out and busy with his day job.