owncloud / owncloud/core

[QA] oc_appconfig stores passwords unencrypted

Open
#38,989 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

QA:team
Dominant language
PHP
Stars
8.8k
Forks
2.1k
Avg merge
20h 7m
Merged PRs (30d)
41

Description

Seen in oc 10.8.0-beta2

#38728 encrypts mount passwords stored in the database. But there are more locations where passwords are stored unencrypted:

MariaDB [owncloud]> select * from oc_appconfig where configkey like '%pass%';
+-----------+------------------------+--------------+
| appid     | configkey              | configvalue  |
+-----------+------------------------+--------------+
| user_ldap | s01ldap_agent_password | b3duY2xvdWQ= |
| user_ldap | s02ldap_agent_password | UEBzc3cwcmQ= |
+-----------+------------------------+--------------+
2 rows in set (0.005 sec)

These two are base64 encoded, and can be trivially converted back to their plain text representation (owncloud and P@ssw0rd)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how the user_ldap s01ldap_agent_password and s02ldap_agent_password values are stored in oc_appconfig, using the behavior from #38728 as a reference. Done means these passwords are encrypted at rest rather than merely base64 encoded; verify the resulting database values and the LDAP configuration behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
mariadb, php
Domain
database, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.