Pre-V1 audit: security review and threat model #178

One of the audits to finish before 1.0. This issue tracks the security review; each finding is a sub-issue.

Scope

The six areas named for the audit, checked against the threat model in SECURITY.md:

1. the dashboard's admin API and sign-in (tokens, session cookie, Host check, roles, trusted identity headers, gateway keys)
2. CSRF (the same-origin check on writes, side-effecting GETs, CORS)
3. the CLI connectors and every other place that starts a process or opens a URL
4. the key ring (Data Protection, the secret file, ${env:} / ${secret:} references, masking)
5. the desktop app's web-view bridge
6. update-feed integrity (Velopack feed, publisher check, installers' update step)

Method

• Read SECURITY.md, docs/dashboard.md, docs/host.md, docs/providers.md, docs/desktop.md and docs/enterprise.md.
• Read the code: DashboardAccess, RouterDashboardEndpoints, SetupApi, EvaluationApi, TuningApi, GatewayGuard, RouterConfiguration (masking, reference rules, process settings), Secrets/*, KeyRing, OwnerOnly, Connectors/Cli/*, AnswerJudge, ServicePlatforms, Desktop/* (bridge, window, shell, updater, publisher check) and deploy/*.
• Wrote one scratch unit check of the reference rules.
• Ran the existing security tests (DashboardRole|Secrets|DashboardAccess|CliScratch|CliExecutable|Gateway|UpdatePublisher|DesktopUpdater|KeyRing|Session): 147 passed, 0 failed.

What held up

• Tokens and gateway keys: compared in constant time (SHA-256, then FixedTimeEquals). Dashboard tokens need at least 16 characters and must differ from each other. Access is refused when a token reference does not resolve.
• Session cookie: HttpOnly, SameSite=Strict, Secure over HTTPS, and HMAC-signed. Sessions are revoked on the server and the revocations are kept in SQLite.
• Host check: guards against DNS rebinding.
• TrustedIdentityHeader: believed only from a known proxy, and refused when repeated or given as a list.
• Metrics role: works as an allow-list.
• Same-origin check: applies to every non-GET and to GETs marked as writes.
• Browser hardening: no CORS, a strict CSP with no inline script, frame-ancestors 'none'.
• Masked secrets: a masked *** only restores a secret to the same destination.
• CLI process start:
  • ArgumentList, no shell, and absolute-path resolution that skips relative PATH entries
  • .cmd, .bat and .ps1 refused, and the whole process tree is killed
  • an owner-only scratch parent, and the prompt sent on stdin
• Key ring: 0700/0600 on Unix and DPAPI on Windows. Unencrypted keys are replaced.
• Update feed: refuses plain HTTP.
• Publisher check: guards against path traversal and uses WinVerifyTrust or codesign --deep --strict.

Threat model

Reported privately

4 findings that could be used against a current install are not filed here. Following SECURITY.md, they go to private security advisories and will be published when they are fixed.

Not checked here

These need Windows or macOS machines and are covered by the hands-on pass:

• WebView2 and WKWebView navigation behaviour
• DPAPI
• Authenticode and codesign

Also not checked:

• Velopack's own hash-verification internals
• the vendor CLIs' argument parsers
• a full XSS pass over the dashboard scripts (spot-checked only: the h() escaping and the CSP)
• prompted tool-call forgery, which is tracked in Make prompted tool calls harder to forge #111

Done when

• Every sub-issue is closed or deliberately deferred past 1.0.
• The private advisories are fixed and published.