Added security in the cookies

[veenoise]

Can I be a part of your development team as a Pen Tester?

Good day, 

My name is William Eduard Chua. I am a 3rd year Computer Science student from PUP - Sta. Mesa. I found out about kabsu.me from my friends studying at CVSU. And, I think it is a great project. I  want to add this bug bounty and application vulnerability assessment work to my portfolio.

Your project looks amazing, but I found a security issue with your application. And, here is my proof of concept:

The image below is a flask application that will serve as my server to receive the cookies.

The next image is the malicious web extension that talks with the flask app; sending the cookies with fetch POST. I used ngrok as a tunneling service to have an HTTPS to HTTPS connection with the command ngrok http 5000. This is for testing only, ngrok is only available for 1 hour, but a malicious actor can make a permanent tunnel with Cloudflare. 

 

Likelihood:

The attack would be possible if the attacker convinced the victim to install the web extension. Essentially, the malicious actor can make a trojan horse, e.g. the attacker can create a web extension that themes your student portal to convince people to install it.  The image below shows the manifest of the web extension. The"matches" can be modified to work with other endpoints like "https://myportal.cvsu.edu.ph/*" to implement the theme extension.

Solution:

Ensure that the cookies have HttpOnly and Secure flags checked. 

Purpose of HttpOnly:

HttpOnly prevents the javascript execution of the command document.cookie. This is the root cause of why my proof of concept was successful.

Purpose of Secure:

This ensures the cookie is sent through HTTPS which is encrypted and not readable.

Code Security:

I am not certain if this would work or if this is the right way to set the cookie options in Superbase. Please test this out first before pushing. 

The desired result should be after logging in, check the cookies from developer options > application > cookies > https://kabsu.me. Check if the two cookies sb-mcquriygnthreskhulbh-auth-token.0 and sb-mcquriygnthreskhulbh-auth-token.1 have HttpOnly and Secure checked.

I am hoping for your swift response and consideration. Have a great day ahead.

Sincerely,
William Eduard Chua

[vercel]

@veenoise is attempting to deploy a commit to the kabsu Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
kabsudotme	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 11, 2024 2:21am
kabsudotme-ngl	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 11, 2024 2:21am

[bricesuazo]

Hi William,

Thank you for your interest in contributing to our project! We'd be glad to have you as a contributor.

Your write-up looks great—could you please extend it to include the other Supabase server client? Also, kindly address the linting issues.

Thanks again for your efforts!