Information Disclosure in Actual Finance Tool

Executive Summary

The vulnerability exists in the Actual personal finance tool prior to version 26.6.0. Specifically, the GET /secret/:name endpoint in the @actual-app/sync-server only checks if the caller has a valid session but does not verify if the caller is an admin. This allows any authenticated non-admin BASIC user in OpenID multi-user deployments to access and probe the secrets store.

As a result, these users can discover which admin-managed bank-sync integrations have been configured, including sensitive secrets such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and gocardless secrets.

This issue was fixed in version 26.6.0 by enforcing proper admin checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to enumerate admin-managed secrets using the GET /secret/:name endpoint with a non-admin authenticated user in OpenID mode.

An attacker or tester can send HTTP GET requests to the /secret/:name endpoint with various known secret names such as gocardless_secretId, simplefin_accessKey, or pluggyai_clientSecret.

If the server responds with HTTP status 204, it indicates the secret exists; if it responds with 404, the secret does not exist. This difference in response codes reveals which admin-managed secrets are configured.

Example command using curl to test for a secret named 'simplefin_accessKey':

• curl -i -H "Authorization: Bearer <non-admin-user-token>" https://<actual-server>/secret/simplefin_accessKey

By automating such requests for a list of known secret names, one can detect if the vulnerability exists by observing 204 vs 404 responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing any authenticated non-admin user to access sensitive secret information related to bank-sync integrations that should only be accessible by administrators.

Exposure of these secrets could lead to unauthorized access or misuse of financial integrations, potentially compromising the security and privacy of financial data.

However, the CVSS base score of 4.3 indicates a medium severity impact, with limited scope to confidentiality and no impact on integrity or availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated non-admin user in OpenID multi-user deployments to access information about admin-managed bank-sync integrations, including sensitive secrets such as access keys and client secrets.

Such unauthorized disclosure of sensitive financial integration secrets could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive personal and financial information.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the Actual application to version 26.6.0 or later, where the issue is fixed.

Useful 0 Not Useful 0