diff --git a/REGISTER.md b/REGISTER.md index c492898..71d622d 100644 --- a/REGISTER.md +++ b/REGISTER.md @@ -1,20 +1,21 @@ # Register -Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-21. +Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-23. -7 live of 9 findings; 3 notes below the floor. +8 live of 10 findings; 3 notes below the floor. ## Findings | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | unset | unset | unset | railiance-platform | open | instant (0) | — | | [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | embargoed | none | railiance-platform | open | instant (0) | **due** | | [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | instant (0) | **due** | -| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | 2026-08-21 08:32Z | +| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | **due** | | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | mitigated | instant (0) | **due** | | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | medium | embargoed | none | tenant-engine | open | instant (0) | **due** | -| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | 2026-08-21 14:32Z | +| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | **due** | | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | instant (0) | **due** | | [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | instant (0) | **due** | diff --git a/findings/RISK-F-0010-embedded-backup-webdav-credential.md b/findings/RISK-F-0010-embedded-backup-webdav-credential.md new file mode 100644 index 0000000..dc7dc36 --- /dev/null +++ b/findings/RISK-F-0010-embedded-backup-webdav-credential.md @@ -0,0 +1,60 @@ +--- +id: RISK-F-0010 +type: finding +title: "Forgejo backup source embeds a WebDAV credential default" +status: open +reported_by: railiance-platform +reported_via: railiance-platform +date_reported: "2026-08-23" +system: railiance-platform +environment: production +fix_owner: railiance-platform +fix_tracking: unset +--- + +# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default + +## What is true, as reported + +`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default +to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted +from this finding, along with any fingerprint, length, or copy. + +The literal is in repository history and can be recovered by anyone with access +to affected clones or history. It was also surfaced in captured agent command +output during an attended review on 2026-08-23, which expands the set of places +that must be treated as potentially exposed. + +The value was not used in that operation and its current validity was not +tested. The configured Nextcloud endpoint was independently observed to be a +write-only file drop: metadata listing and reads were denied while the approved +OpenBao-sourced credential could upload ciphertext. Therefore, the established +risk is an embedded credential and possible unauthorized write or storage +injection if it remains live; read access to existing backups is not +established. The age recovery private key is separate and was not found in the +script. + +## How it was found + +Found by source inspection while selecting the approved encrypted off-host +snapshot lane for preparation-only scenario +`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate +with or probe the embedded value. + +## Suggested direction + +Suggestion, owned by `railiance-platform`: + +1. Revoke and regenerate the Nextcloud file-drop credential at the provider. +2. Write the replacement only to the governed OpenBao lane + `platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input + file, then securely remove the input. +3. Remove the source-code default so backup execution fails closed unless the + value arrives through OpenBao or an explicit sanctioned environment. +4. Review reachable Git history, CI and agent logs, and clones under the + applicable retention policy; do not reproduce the credential while doing so. +5. Verify a ciphertext upload and restore after rotation, then clear any + exposure taint only with evidence. + +Risk Nexus owns severity, disclosure, escalation, and review cadence. This +report intentionally does not assign them.