coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
risk-nexus/findings/RISK-F-0010-embedded-backup-webdav-credential.md
tegwick cad7adf851 risk: report embedded backup WebDAV credential 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
2026-08-23 00:39:46 +02:00

2.5 KiB
Raw Blame History

id type title status reported_by reported_via date_reported system environment fix_owner fix_tracking
RISK-F-0010 finding Forgejo backup source embeds a WebDAV credential default open railiance-platform railiance-platform 2026-08-23 railiance-platform production railiance-platform unset

RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default

What is true, as reported

railiance-platform/tools/cmd/forgejo-backup line 13 assigns a literal default to RAILIANCE_BACKUP_NC_TOKEN. The credential value is deliberately omitted from this finding, along with any fingerprint, length, or copy.

The literal is in repository history and can be recovered by anyone with access to affected clones or history. It was also surfaced in captured agent command output during an attended review on 2026-08-23, which expands the set of places that must be treated as potentially exposed.

The value was not used in that operation and its current validity was not tested. The configured Nextcloud endpoint was independently observed to be a write-only file drop: metadata listing and reads were denied while the approved OpenBao-sourced credential could upload ciphertext. Therefore, the established risk is an embedded credential and possible unauthorized write or storage injection if it remains live; read access to existing backups is not established. The age recovery private key is separate and was not found in the script.

How it was found

Found by source inspection while selecting the approved encrypted off-host snapshot lane for preparation-only scenario WARDEN-WP-0027-T02-DRILL-20260822-01. No attempt was made to authenticate with or probe the embedded value.

Suggested direction

Suggestion, owned by railiance-platform:

  1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
  2. Write the replacement only to the governed OpenBao lane platform/workloads/railiance/backup/offsite-lane through a mode-0600 input file, then securely remove the input.
  3. Remove the source-code default so backup execution fails closed unless the value arrives through OpenBao or an explicit sanctioned environment.
  4. Review reachable Git history, CI and agent logs, and clones under the applicable retention policy; do not reproduce the credential while doing so.
  5. Verify a ciphertext upload and restore after rotation, then clear any exposure taint only with evidence.

Risk Nexus owns severity, disclosure, escalation, and review cadence. This report intentionally does not assign them.