ParadoxAlarmInterface / ParadoxAlarmInterface/pai
Use user code from panel to validate partition control messages
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 424
- Forks
- 118
- PR merge metrics
- No merged PRs in 30d
Description
With current implementation any of the client can send a partition control message to pai and easily disarm the system. From the overall system perspective it can lead to a vulnerability.
Disarming should be only possible if a user code is sent back as part of the payload. The sent user code should be validated against the user code(s) in the alarm panel. If the user code is found in the alarm panel the system should make the state change on behalf of the found user. In every other cases the request should be rejected.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the partition control message handler and the alarm panel user-code lookup. Check how disarm requests currently change state, then verify that valid codes act on behalf of the matching user and invalid or missing codes are rejected. Done means unauthorized clients can no longer disarm the system through these messages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100