coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

risk: report embedded backup WebDAV credential

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
tegwick 2026-08-23 00:39:46 +02:00
parent 623f7ccb2e
commit cad7adf851
2 changed files with 65 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
REGISTER.md
View file

@ -1,20 +1,21 @@
# Register
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-21.
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-23.
7 live of 9 findings; 3 notes below the floor.
8 live of 10 findings; 3 notes below the floor.
## Findings
| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | unset | unset | unset | railiance-platform | open | instant (0) | — |
| [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | embargoed | none | railiance-platform | open | instant (0) | **due** |
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | instant (0) | **due** |
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | 2026-08-21 08:32Z |
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | **due** |
| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** |
| [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | mitigated | instant (0) | **due** |
| [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | medium | embargoed | none | tenant-engine | open | instant (0) | **due** |
| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | 2026-08-21 14:32Z |
| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | **due** |
| [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | instant (0) | **due** |
| [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | instant (0) | **due** |

60
findings/RISK-F-0010-embedded-backup-webdav-credential.md Normal file
View file

@ -0,0 +1,60 @@
---
id: RISK-F-0010
type: finding
title: "Forgejo backup source embeds a WebDAV credential default"
status: open
reported_by: railiance-platform
reported_via: railiance-platform
date_reported: "2026-08-23"
system: railiance-platform
environment: production
fix_owner: railiance-platform
fix_tracking: unset
---
# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
## What is true, as reported
`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default
to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted
from this finding, along with any fingerprint, length, or copy.
The literal is in repository history and can be recovered by anyone with access
to affected clones or history. It was also surfaced in captured agent command
output during an attended review on 2026-08-23, which expands the set of places
that must be treated as potentially exposed.
The value was not used in that operation and its current validity was not
tested. The configured Nextcloud endpoint was independently observed to be a
write-only file drop: metadata listing and reads were denied while the approved
OpenBao-sourced credential could upload ciphertext. Therefore, the established
risk is an embedded credential and possible unauthorized write or storage
injection if it remains live; read access to existing backups is not
established. The age recovery private key is separate and was not found in the
script.
## How it was found
Found by source inspection while selecting the approved encrypted off-host
snapshot lane for preparation-only scenario
`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate
with or probe the embedded value.
## Suggested direction
Suggestion, owned by `railiance-platform`:
1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
2. Write the replacement only to the governed OpenBao lane
`platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input
file, then securely remove the input.
3. Remove the source-code default so backup execution fails closed unless the
value arrives through OpenBao or an explicit sanctioned environment.
4. Review reachable Git history, CI and agent logs, and clones under the
applicable retention policy; do not reproduce the credential while doing so.
5. Verify a ciphertext upload and restore after rotation, then clear any
exposure taint only with evidence.
Risk Nexus owns severity, disclosure, escalation, and review cadence. This
report intentionally does not assign them.