tegwick
cad7adf851
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
60 lines
2.5 KiB
Markdown
60 lines
2.5 KiB
Markdown
---
|
|
id: RISK-F-0010
|
|
type: finding
|
|
title: "Forgejo backup source embeds a WebDAV credential default"
|
|
status: open
|
|
reported_by: railiance-platform
|
|
reported_via: railiance-platform
|
|
date_reported: "2026-08-23"
|
|
system: railiance-platform
|
|
environment: production
|
|
fix_owner: railiance-platform
|
|
fix_tracking: unset
|
|
---
|
|
|
|
# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
|
|
|
|
## What is true, as reported
|
|
|
|
`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default
|
|
to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted
|
|
from this finding, along with any fingerprint, length, or copy.
|
|
|
|
The literal is in repository history and can be recovered by anyone with access
|
|
to affected clones or history. It was also surfaced in captured agent command
|
|
output during an attended review on 2026-08-23, which expands the set of places
|
|
that must be treated as potentially exposed.
|
|
|
|
The value was not used in that operation and its current validity was not
|
|
tested. The configured Nextcloud endpoint was independently observed to be a
|
|
write-only file drop: metadata listing and reads were denied while the approved
|
|
OpenBao-sourced credential could upload ciphertext. Therefore, the established
|
|
risk is an embedded credential and possible unauthorized write or storage
|
|
injection if it remains live; read access to existing backups is not
|
|
established. The age recovery private key is separate and was not found in the
|
|
script.
|
|
|
|
## How it was found
|
|
|
|
Found by source inspection while selecting the approved encrypted off-host
|
|
snapshot lane for preparation-only scenario
|
|
`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate
|
|
with or probe the embedded value.
|
|
|
|
## Suggested direction
|
|
|
|
Suggestion, owned by `railiance-platform`:
|
|
|
|
1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
|
|
2. Write the replacement only to the governed OpenBao lane
|
|
`platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input
|
|
file, then securely remove the input.
|
|
3. Remove the source-code default so backup execution fails closed unless the
|
|
value arrives through OpenBao or an explicit sanctioned environment.
|
|
4. Review reachable Git history, CI and agent logs, and clones under the
|
|
applicable retention policy; do not reproduce the credential while doing so.
|
|
5. Verify a ciphertext upload and restore after rotation, then clear any
|
|
exposure taint only with evidence.
|
|
|
|
Risk Nexus owns severity, disclosure, escalation, and review cadence. This
|
|
report intentionally does not assign them.
|