Insecure File Permissions in Vikunja Allow Local Data Exposure

Executive Summary

Vikunja before version 2.7.1 has an insecure file permissions vulnerability where localStorage.Write creates blobs with world-readable permissions. This allows local attackers on shared hosts to read sensitive data such as attachments, project backgrounds, exports, and the SQLite database. Attackers can copy the SQLite database to attempt cracking password hashes offline.

Useful 0 Not Useful 0

Detection Guidance

Check file permissions on Vikunja storage directories and files. Use commands like 'find /path/to/vikunja -type f -perm 0644' to identify world-readable files. Inspect SQLite database permissions with 'ls -la /path/to/database.sqlite'. Verify if blobs in localStorage have 0644 permissions.

Useful 0 Not Useful 0

Impact Analysis

If you use Vikunja on a shared host, local attackers could access your stored data including attachments, project backgrounds, exports, and password hashes. This could lead to data breaches, unauthorized access to sensitive information, and potential offline cracking of user passwords.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches that require reporting under these regulations, potential fines for non-compliance, and loss of trust due to inadequate data protection measures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later. Set file permissions to 0600 for blobs and 0700 for storage directories. Adjust systemd unit with UMask=0077. Manually correct existing file permissions to 0600 for sensitive files.

Useful 0 Not Useful 0