31 lines
3.1 KiB
Markdown
31 lines
3.1 KiB
Markdown
|
# Security Audit (S-01-08, S-21-30) — agent #6
|
||
|
|
|
||
|
|
**Headline:** 1 medium finding (S-23 plaintext S3 access key ID), 19 clean.
|
||
|
|
|
||
|
|
## 🟡 MEDIUM S-23: S3 access key ID stored plaintext in `system_settings`
|
||
|
|
|
||
|
|
- **File:** `src/lib/storage/index.ts:136`, `src/components/admin/storage-admin-panel.tsx:80`
|
||
|
|
- **What:** S3 secret key (`storage_s3_secret_key_encrypted`) is AES-encrypted, but the access key ID (`storage_s3_access_key`) is stored/read as plaintext in `system_settings`.
|
||
|
|
- **Why it matters:** Asymmetric encryption — DB exfil exposes the IAM key ID, narrowing the attack surface for credential stuffing or confirming which IAM principal to target. The access key ID is also surfaced in admin settings API responses.
|
||
|
|
- **Suggested fix:** Apply same `encrypt()` / `*IsSet` pattern as the secret key. Migration to re-key existing rows. Update `resolveConfig` to call `decryptIfPresent`.
|
||
|
|
|
||
|
|
## ✅ Passing checks
|
||
|
|
|
||
|
|
- S-01 XSS via client.fullName (React text node)
|
||
|
|
- S-02 XSS via tag.name (React child, sanitized style object)
|
||
|
|
- S-03 XSS via note.content (plain text, no markdown rendering — `whitespace-pre-wrap` is CSS only)
|
||
|
|
- S-04 XSS via email body markdown (`src/lib/utils/markdown-email.ts` escape-then-allowlist + DOMPurify second layer in `send-document-dialog.tsx`)
|
||
|
|
- S-05 SQL injection via search query (Drizzle parameterized; `sql.raw` only on hardcoded constants in `admin/storage/route.ts:30` and `storage/migrate.ts:149`)
|
||
|
|
- S-06 Path traversal in folder name (DB-only, never used as filesystem path)
|
||
|
|
- S-07 Path traversal in file name / storage key (`validateStorageKey` in `src/lib/storage/filesystem.ts:49-69` rejects `..`/absolute/empty/non-allowlist chars; `resolveKey` does `path.resolve` prefix check)
|
||
|
|
- S-08 SSRF via webhook target URL (two-layer: `isLocalOrPrivateHost` in `src/lib/validators/webhooks.ts` blocks RFC1918+loopback+link-local+CGNAT+cloud metadata; `resolveAndCheckHost` in `src/lib/queue/workers/webhooks.ts` re-resolves DNS at dispatch — DNS rebinding-resistant)
|
||
|
|
- S-21 SMTP credential AES-256-GCM with random IV (`src/lib/utils/encryption.ts`)
|
||
|
|
- S-22 IMAP credential same path as SMTP
|
||
|
|
- S-24 Privilege escalation blocked: `updateUser` in `src/lib/services/users.service.ts:294-318` does caller-superset check; permission-overrides at `src/app/api/v1/admin/users/[id]/permission-overrides/route.ts:203-210` enforce per-leaf + block self-target at line 160; role definition mutations require `requireSuperAdmin` not just `manage_users`
|
||
|
|
- S-25 Direct ID enumeration immune (`crypto.randomUUID` everywhere)
|
||
|
|
- S-26 Audit log read-back of own permission denials — clean (admin-only `view_audit_log`)
|
||
|
|
- S-27 Magic-byte verification verified
|
||
|
|
- S-28 Filename HTML-escape in download links (`src/lib/services/document-sends.service.ts:415-420`)
|
||
|
|
- S-29 Bounce-monitor email subject parsing — clean (no IMAP bounce worker exists yet; `email-threads.service.ts` uses parameterized `ilike` for subject matching)
|
||
|
|
- S-30 `EMAIL_REDIRECT_TO` enforced at boot via Zod `superRefine` in `src/lib/env.ts:110-117` — production with the env set causes `process.exit(1)`. Webhook worker also short-circuits to `dead_letter` when set.
|