annikav9 / carrotsh

A lightweight and secure remote access server that allows clients to connect through a browser.

Monero

86CsrhjPTF7QH9iLT5tJKaLkGAa2R4hzA8yyCTizzRDSJFNkJ4dAjGfb44cJSA2ZEKjjvxz4cjGdCGHibdcCkx3rQZULWYo

Email (PGP Encryption Supported)

[email protected]

-----BEGIN PGP PUBLIC KEY BLOCK-----
xjMEY/4jPBYJKwYBBAHaRw8BAQdA4nCyM9n4T5O0VbmxWIrqXRuiERc2XmrU
xRrQwbCiljDNF2hpQGF2OS5kZXYgPGhpQGF2OS5kZXY+wowEEBYKAD4FAmP+
IzwECwkHCAkQ9e1z3RK8g4EDFQgKBBYAAgECGQECGwMCHgEWIQTEX1TU5VAq
jGgzUPH17XPdEryDgQAAvNEBAKuO4oJtIbfjaKvWRo9XQSNhnKGRPkkiD1um
ESMP/of7AP9Uufm62R8OyzJSmupeG4UdivtF9f1gCl5tED8daMfqAc44BGP+
IzwSCisGAQQBl1UBBQEBB0B41r2Lmio+Y4ua09mvTYqBfm6mfJqqUumgWneb
ttGCdwMBCAfCeAQYFggAKgUCY/4jPAkQ9e1z3RK8g4ECGwwWIQTEX1TU5VAq
jGgzUPH17XPdEryDgQAA52IA/RjfWdkqqjI0q21heHl0oK6Wpijal67ev5Ou
Bvl7UFsxAP9HVXn03X+chx2RdMyeZCp34Vwt0unsOTFiqEiJGfj9CA==
=j3R5
-----END PGP PUBLIC KEY BLOCK-----

carrotsh's Issues

Plaintext storage of TOTP secret key

Severity: Low (At the moment)

The Issue

The TOTP secret key generated by the server is stored as plaintext in login/2fa_key. While it is unlikely anyone who doesn't have access to the server can retrieve this key, this may change when new bugs or vulnerabilities surface in future updates.

commands/csh_setup_2fa.py#L16-L19

Patch Status

This issue has not been patched yet.

• Symmetric/Asymmetric encryption with key file(s) is pointless, since the encryption key needs to be stored in the same server, and will face the same issue as the plaintext 2fa secret key.
• Encrypting the 2fa key with the user password as the encryption passphrase is also not feasible, as the whole point of having an otp system is to keep the server secure even if the password is compromised.

A method to save the key in the operating system's keyring/keychain/secret-service is being worked on at the moment.

Workarounds

• Ensure that only trusted user accounts can access the carrotsh directory in your server.
• Ensure that no other webserver/fileserver is exposing the carrotsh directory to the internet.

If you do have a proper solution, feel free to make a pull request which references this issue