tegwick
7f1424dbcf
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
123 lines
5.3 KiB
Markdown
123 lines
5.3 KiB
Markdown
---
|
||
id: RISK-F-0010
|
||
type: finding
|
||
title: "Forgejo backup source embeds a WebDAV credential default"
|
||
status: open
|
||
owner: risk-nexus
|
||
reported_by: railiance-platform
|
||
reported_via: railiance-platform
|
||
routed_by: risk-nexus
|
||
date_reported: "2026-08-23"
|
||
date_filed: "2026-08-23"
|
||
system: railiance-platform
|
||
environment: production
|
||
fix_owner: railiance-platform
|
||
fix_tracking: unset
|
||
# Graded by risk-nexus 2026-09-01 — docs/rulings/2026-09-01-inbox-sweep.md
|
||
severity: low
|
||
severity_at_production: low
|
||
impact: I2
|
||
likelihood: L2
|
||
fidelity_modifier: false
|
||
production_rescore: false
|
||
disclosure: embargoed
|
||
embargo_condition: "the provider credential is revoked or invalidated and the literal source default is removed"
|
||
embargo_since: "2026-09-01"
|
||
embargo_review: "2026-09-15"
|
||
escalation: none
|
||
last_checked: "2026-09-01T00:32:44Z"
|
||
next_check: "2026-09-01T00:32:44Z"
|
||
cadence: instant
|
||
clean_streak: 0
|
||
waiting_on:
|
||
- who: railiance-platform
|
||
what: "revoke or invalidate the provider credential, remove the source default, name fix tracking, and demonstrate governed ciphertext upload plus restore"
|
||
since: "2026-09-01"
|
||
would_change: "the finding becomes fixed and the embargo lifts"
|
||
default: "the low grade and embargo stand; missing fix tracking is recorded as a stalled remediation"
|
||
default_at: "2026-09-15"
|
||
graded_by: risk-nexus
|
||
ruling: RISK-RULING-2026-09-01-A
|
||
checked_by: "codex/risk-nexus"
|
||
---
|
||
|
||
# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
|
||
|
||
## What is true, as reported
|
||
|
||
`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default
|
||
to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted
|
||
from this finding, along with any fingerprint, length, or copy.
|
||
|
||
The literal is in repository history and can be recovered by anyone with access
|
||
to affected clones or history. It was also surfaced in captured agent command
|
||
output during an attended review on 2026-08-23, which expands the set of places
|
||
that must be treated as potentially exposed.
|
||
|
||
The value was not used in that operation and its current validity was not
|
||
tested. The configured Nextcloud endpoint was independently observed to be a
|
||
write-only file drop: metadata listing and reads were denied while the approved
|
||
OpenBao-sourced credential could upload ciphertext. Therefore, the established
|
||
risk is an embedded credential and possible unauthorized write or storage
|
||
injection if it remains live; read access to existing backups is not
|
||
established. The age recovery private key is separate and was not found in the
|
||
script.
|
||
|
||
## How it was found
|
||
|
||
Found by source inspection while selecting the approved encrypted off-host
|
||
snapshot lane for preparation-only scenario
|
||
`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate
|
||
with or probe the embedded value.
|
||
|
||
## Suggested direction
|
||
|
||
Suggestion, owned by `railiance-platform`:
|
||
|
||
1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
|
||
2. Write the replacement only to the governed OpenBao lane
|
||
`platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input
|
||
file, then securely remove the input.
|
||
3. Remove the source-code default so backup execution fails closed unless the
|
||
value arrives through OpenBao or an explicit sanctioned environment.
|
||
4. Review reachable Git history, CI and agent logs, and clones under the
|
||
applicable retention policy; do not reproduce the credential while doing so.
|
||
5. Verify a ciphertext upload and restore after rotation, then clear any
|
||
exposure taint only with evidence.
|
||
|
||
Risk Nexus owns severity, disclosure, escalation, and review cadence. This
|
||
report intentionally does not assign them.
|
||
|
||
## Register ruling — 2026-09-01
|
||
|
||
`low` (`I2` × `L2`), embargoed, no escalation.
|
||
|
||
**`I2`: limited to one backup lane on the facts established.** If the embedded
|
||
value remains valid, it can authorize an ungoverned write or storage injection
|
||
at the Nextcloud file-drop endpoint. Metadata listing and reads were denied,
|
||
backup content is ciphertext, and the age recovery private key is separate.
|
||
Nothing here establishes disclosure of an existing backup or estate-wide
|
||
credential reach.
|
||
|
||
**`L2`: recoverable through access the estate does grant.** The value is in Git
|
||
history and appeared in captured agent output, so a repository clone or retained
|
||
log is a sufficient foothold. Current validity is unknown and is not tested by
|
||
this register; unknown is not treated as either live or revoked.
|
||
|
||
**Embargoed.** While the source default remains and validity is unresolved,
|
||
publishing that a recoverable provider credential exists materially shortens the
|
||
path beyond reading the private repository. The hold lifts only when revocation
|
||
or invalidation and removal of the literal are both observable. The credential
|
||
value, fingerprint, and shape remain excluded from every record and message.
|
||
|
||
**No escalation.** There is no evidence of a read, loss, real-person data
|
||
exposure, legal notification duty, new spend, ownership dispute, or a stalled
|
||
remediation yet. Railiance Platform owns both the source and provider action.
|
||
Silence defaults on 2026-09-15 to the existing grade and a recorded stall; it
|
||
does not soften the assessment.
|
||
|
||
Reasoning: `docs/rulings/2026-09-01-inbox-sweep.md`.
|
||
|
||
## Reviews
|
||
|
||
- **2026-09-01** — graded from the filed report and a redacted current-source check. The literal default remains; no fix record was found. Cadence starts at instant.
|