Bug 393988 - Discover flatpack integration retrieves resources over http and is vulnerable to MitM attack
Summary: Discover flatpack integration retrieves resources over http and is vulnerable...
Status: RESOLVED DUPLICATE of bug 393987
Alias: None
Product: Discover
Classification: Applications
Component: Flatpak Backend (other bugs)
Version First Reported In: 5.12.5
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Aleix Pol
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-08 10:42 UTC by Nikita Skovoroda
Modified: 2018-05-08 14:02 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nikita Skovoroda 2018-05-08 10:42:34 UTC
To reproduce: add `distribute.kde.org/kderuntime.flatpakrepo`.

The repo file, including the GPGKey, is by default retrieved over http, and could be tampered with.

There are several problems here:

1. Discover supports adding http:// resources as flatpack repos and does not warn that that is insecure.
2. Discover supports adding repos without protocol and defaults those to http:// instead of https://
3. distribute.kde.org is configured to support http://distribute.kde.org and answers to it (to reproduce — open http://distribute.kde.org in «private mode» or just curl it). HSTS does not redirect by itself. See https://www.troyhunt.com/understanding-http-strict-transport/ for more details

The proposed fix would be:
1. Warn on http:// repos, perhaps with an additional confirmation box
2. Default protocol-less addresses to https:// instead of http://
3. Properly configure HSTS and http->https redirects on distribute.kde.org, according to https://www.troyhunt.com/understanding-http-strict-transport/
Comment 1 Aleix Pol 2018-05-08 13:38:16 UTC

*** This bug has been marked as a duplicate of bug 393987 ***
Comment 2 Nikita Skovoroda 2018-05-08 14:02:45 UTC
Sorry, I have no idea why this was submitted twice.

Perhaps I could have accidentally double-tapped the submit button twice on the touchpad before the next page was loaded? Still strange that Bugzilla didn't prevent this though.