Impact
To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing.
The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf.
Patches
This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2
Workarounds
If you cannot update to the patched version immediately, you can disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the hocuspocus container should also be disabled.
Credits
The vulnerability has been responsibly disclosed through the YesWeHack bounty program for OpenProject by Scott Curtis (syndrome_impostor). Thank you for the responsible disclosure and your collaboration in this report!
syndrome-impostor Reporter
Impact
To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing.
The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf.
Patches
This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2
Workarounds
If you cannot update to the patched version immediately, you can disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the
hocuspocuscontainer should also be disabled.Credits
The vulnerability has been responsibly disclosed through the YesWeHack bounty program for OpenProject by Scott Curtis (syndrome_impostor). Thank you for the responsible disclosure and your collaboration in this report!