Merge branch 'develop' into 'master'

Merge 'develop' into 'master' See merge request passbolt/passbolt-help!408
passbolt · Apr 15, 2024 · f6696f4 · f6696f4
2 parents 3a7daaa + 79786dd
commit f6696f4
Show file tree

Hide file tree

Showing 30 changed files with 856 additions and 57 deletions.
diff --git a/_incidents/2024-04-15-PBL-11-security-audit-results.md b/_incidents/2024-04-15-PBL-11-security-audit-results.md
@@ -0,0 +1,79 @@
+---
+title: PBL-11 Security audit results
+date: 2024-04-15 00:00:00 Z
+description: PBL-11 Security audit results
+categories: [incidents]
+layout: incidents
+slug: PBL-11 Security audit results
+permalink: /incidents/20240415_PBL-11-security-audit-results
+---
+
+{% include layout/row_start.html %}
+{% include layout/col_start.html column="7" %}
+
+## Introduction
+
+In the lead-up to the stable release of the Passbolt UWP Windows application, the Cure53 team dedicated two days to a focused audit on the application's native layer. This review revealed a total of five findings—four security vulnerabilities and one general weakness—which were all solved prior to the v1.0 release.
+
+Quotes from the conclusion of the report: “Upon completion of this security audit, Cure53 gained a strong impression of the security premise employed by the Passbolt team. The quality of the codebase was generally impressive, while the architecture and frameworks employed generally installed resilient design paradigms.”
+
+In addition to the detailed findings of this audit, the security incident section also houses separate reports that examine the browser extensions. Interestingly, some of the code of the extension is also used in the Desktop application, and will give more details on other components of this application.
+
+All the issues have been fixed or mitigations have been implemented as of 11th April 2024.
+
+You can read more about the security audit by [reading the full report](/assets/files/PBL-11-report.pdf).
+
+A big thank you from the Passbolt team to Cure53 for their collaborative spirit and expertise shared during this project.
+
+## Vulnerabilities summary
+
+<table class="table-parameters">
+  <thead>
+    <tr>
+      <th>ID</th>
+      <th>Issue name</th>
+      <th>Severity</th>
+      <th>Status</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>PBL-11-001</td>
+      <td>Insecure Regex pattern allows canNavigate bypass</td>
+      <td>Medium</td>
+      <td>Mitigated in v1.0</td>
+    </tr>
+    <tr>
+      <td>PBL-11-002</td>
+      <td>PasswordVault can be accessed by Desktop apps</td>
+      <td>Low</td>
+      <td>Mitigated in v1.0</td>
+    </tr>
+    <tr>
+      <td>PBL-11-003</td>
+      <td>JS execution by modifying LocalFolder Resources</td>
+      <td>Low</td>
+      <td>Mitigated in v1.0</td>
+    </tr>
+    <tr>
+      <td>PBL-11-004</td>
+      <td>Insecure CSP Configuration in renderers</td>
+      <td>Low</td>
+      <td>Mitigated in v1.0</td>
+    </tr>
+    <tr>
+      <td>PBL-11-005</td>
+      <td>Arbitrary requestId used as topic in background</td>
+      <td>Medium</td>
+      <td>Mitigated in v1.0</td>
+    </tr>
+  </tbody>
+</table>
+
+{% include date/updated.html %}
+
+{% include layout/col_end.html %}
+{% include layout/col_start.html column="4 last push1" %}
+
+{% include layout/col_end.html %}
+{% include layout/row_end.html %}
diff --git a/_pages/incidents/index.html b/_pages/incidents/index.html
@@ -18,21 +18,21 @@ <h1>All the incidents</h1>
                             {% assign items = site.incidents | sort: 'date' %}
 
                             <h3>Recent issues</h3>
-                            <h2>2023</h2>
+                            <h2>2024</h2>
                             {% for item in items reversed %}
                             {% assign pre_date = item.date | date: '%Y' %}
-                            {% if pre_date == '2023' %}
+                            {% if pre_date == '2024' %}
                             <li>
                                 <span style=""><a href="{{ item.url }}">{{ item.title }}</a></span> -
                                 <span style="color:#888;">{% include date/format-date.html date=item.date %}</span>
                             </li>
                             {% endif %}
                             {% endfor %}
 
-                            <h2>2022</h2>
+                            <h2>2023</h2>
                             {% for item in items reversed %}
                             {% assign pre_date = item.date | date: '%Y' %}
-                            {% if pre_date == '2022' %}
+                            {% if pre_date == '2023' %}
                             <li>
                                 <span style=""><a href="{{ item.url }}">{{ item.title }}</a></span> -
                                 <span style="color:#888;">{% include date/format-date.html date=item.date %}</span>
@@ -43,7 +43,7 @@ <h2>2022</h2>
                             <h3 style="margin-top:2em">Older issues</h3>
                             {% for item in items reversed %}
                             {% assign pre_date = item.date | date: '%Y' %}
-                            {% if pre_date == '2017' or pre_date == '2016' or pre_date == '2018' or pre_date == '2019' or pre_date == '2020' or pre_date == '2021' %}
+                            {% if pre_date == '2017' or pre_date == '2016' or pre_date == '2018' or pre_date == '2019' or pre_date == '2020' or pre_date == '2021' or pre_date == '2022' %}
                             <li>
                                 <span style=""><a href="{{ item.url }}">{{ item.title }}</a></span> -
                                 <span style="color:#888;">{% include date/format-date.html date=item.date %}</span>

diff --git a/assets/files/PBL-11-report.pdf b/assets/files/PBL-11-report.pdf
diff --git a/docs/assets/files/PBL-11-report.pdf b/docs/assets/files/PBL-11-report.pdf
diff --git a/docs/feed.xml b/docs/feed.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.1">Jekyll</generator><link href="https://help.passbolt.com/feed.xml" rel="self" type="application/atom+xml" /><link href="https://help.passbolt.com/" rel="alternate" type="text/html" /><updated>2024-04-12T09:45:21+02:00</updated><id>https://help.passbolt.com/feed.xml</id><title type="html">Passbolt | Help</title><subtitle>The help site for passbolt, the open source password manager for teams. This site contains frequently asked questions, article to troubleshoot common issues, installation tutorials, blueprints for developers, and more!</subtitle></feed>
+<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.1">Jekyll</generator><link href="https://help.passbolt.com/feed.xml" rel="self" type="application/atom+xml" /><link href="https://help.passbolt.com/" rel="alternate" type="text/html" /><updated>2024-04-15T11:33:41+02:00</updated><id>https://help.passbolt.com/feed.xml</id><title type="html">Passbolt | Help</title><subtitle>The help site for passbolt, the open source password manager for teams. This site contains frequently asked questions, article to troubleshoot common issues, installation tutorials, blueprints for developers, and more!</subtitle></feed>
diff --git a/docs/incidents/20170210_chrome_not_available.html b/docs/incidents/20170210_chrome_not_available.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20170914_xss_on_resource_urls.html b/docs/incidents/20170914_xss_on_resource_urls.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20171013_passphrase_information_leakage.html b/docs/incidents/20171013_passphrase_information_leakage.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20171228_content_scripts_malicious_domain.html b/docs/incidents/20171228_content_scripts_malicious_domain.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20180508_password_generator_prng.html b/docs/incidents/20180508_password_generator_prng.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20180509_nginx_webroot_configuration.html b/docs/incidents/20180509_nginx_webroot_configuration.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20181109_gke_incident.html b/docs/incidents/20181109_gke_incident.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20190211_multiple_vulnerabilities.html b/docs/incidents/20190211_multiple_vulnerabilities.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20190807_multiple_vulnerabilities.html b/docs/incidents/20190807_multiple_vulnerabilities.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20191126_autofill_suggestions.html b/docs/incidents/20191126_autofill_suggestions.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20210210_v3_webextension_issues.html b/docs/incidents/20210210_v3_webextension_issues.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20210419_PBL01_Cure53_report.html b/docs/incidents/20210419_PBL01_Cure53_report.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20211124_PBL_06_008_v331_Cure53_report.html b/docs/incidents/20211124_PBL_06_008_v331_Cure53_report.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20220920_spell-jacking.html b/docs/incidents/20220920_spell-jacking.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20230404_android-app-unlisted.html b/docs/incidents/20230404_android-app-unlisted.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">

diff --git a/docs/incidents/20230426_sending-unencrypted-description.html b/docs/incidents/20230426_sending-unencrypted-description.html
@@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2>
 
 
 
+        <li>
+
+            <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+April
+15th,
+2024
+</a>
+        </li>
+
+
         <li>
 
             <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.1">Jekyll</generator><link href="https://help.passbolt.com/feed.xml" rel="self" type="application/atom+xml" /><link href="https://help.passbolt.com/" rel="alternate" type="text/html" /><updated>2024-04-12T09:45:21+02:00</updated><id>https://help.passbolt.com/feed.xml</id><title type="html">Passbolt \| Help</title><subtitle>The help site for passbolt, the open source password manager for teams. This site contains frequently asked questions, article to troubleshoot common issues, installation tutorials, blueprints for developers, and more!</subtitle></feed>
		<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.1">Jekyll</generator><link href="https://help.passbolt.com/feed.xml" rel="self" type="application/atom+xml" /><link href="https://help.passbolt.com/" rel="alternate" type="text/html" /><updated>2024-04-15T11:33:41+02:00</updated><id>https://help.passbolt.com/feed.xml</id><title type="html">Passbolt \| Help</title><subtitle>The help site for passbolt, the open source password manager for teams. This site contains frequently asked questions, article to troubleshoot common issues, installation tutorials, blueprints for developers, and more!</subtitle></feed>
-Original file line number
+Diff line change
@@ Expand Up / @@ -95,6 +95,16 @@ <h2 class="visuallyhidden">Help Search</h2> @@
+            <li>
+                <a href="https://help.passbolt.com/incidents/20240415_PBL-11-security-audit-results">
+    April
+th,
+    </a>
+            </li>
             <li>
                 <a href="https://help.passbolt.com/incidents/20230911_PBL-09-security-audit-results">
@@ Expand Down @@