HelloZeroNet / HelloZeroNet/ZeroNet

Low seeded zites can be manipulated, they can be rendered unusable security issue

未关闭
#2,844 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
18.8k
派生
2.3k
PR 合并指标
30 天内没有已合并 PR

描述

* ZeroNet version: ZeroNetX 0.9.0 (Rev 4630), 4.8.5 (Rev 4625), Conservacy 0.7.10+ (Rev 8192), Zeronet 0.7.2 (Rev 4555) and all older versions, forks.

* Operating system: All
* Web browser: _____
* Tor status: not available/always/disabled
* Opened port: yes/no
* Special configuration: ____

The attack are working on zites what are low seeded and the original owner are not non-stop seeded the zite. The attacker using outdated version of the current zite, or deleting some files. If users who have the original page connect, the user who downloaded the page from the attacker cannot update it. If the page refresh him self get in updated status, with missing file or outdated content. There are two points of vulnerability in the system. In the file update system, and in the content.json, time coding system.

If some files are missing, the automatic refres page does not working, in some forks check files if have a user who have the files may work. In the „outdated attack” the site owner need later time sign and publish the content. This phenomenon occurs if new content is published several times within a short period of time that day.

After X failed time the download system give up updating the content. The attack can make useless low seeded zites.

The result: Missing files in the zites, or loaded a outdated version of the zite. Both case can not updated later the zites from another users.

贡献指南

这个仓库没有索引到贡献指南

调研方向

报告没有提及任何文件、测试或入口点。首先复现涉及文件缺失和内容过时的低种子数更新失败,然后验证受影响的 zites 能够从另一位用户处恢复更新,同时不会变得不可用。

由索引模型根据 Issue 内容生成。

评估

技术栈
javascript, python
领域
distributed-systems, security
Issue 类型
缺陷
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
需要澄清
新手友好度
20/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。