Mailing-List: contact dev-help@airflow.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@airflow.incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <CAN4Q8dCr6b2HpMy3tYZyU=g626FAOohF0PeZpL=oHXn1_tgf=A@mail.gmail.com>
References: <CAN4Q8dCr6b2HpMy3tYZyU=g626FAOohF0PeZpL=oHXn1_tgf=A@mail.gmail.com>
From: Maxime Beauchemin <maximebeauchemin@gmail.com>
Date: Thu, 18 Aug 2016 22:53:40 -0700
Message-ID: <CAHEEp7XopwQ7anAskQgYOL62a8JXQ_Qjva5GeH7Gj5jfLKZZfg@mail.gmail.com>
Subject: Fwd: Possible security bug in incubator-airflow OAuth GitHub
 Enterprise auth
To: dev@airflow.incubator.apache.org
Cc: patrick.toomey@github.com
Content-Type: multipart/alternative; boundary=001a114a6d7604c98f053a665290
archived-at: Fri, 19 Aug 2016 05:53:47 -0000

--001a114a6d7604c98f053a665290
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Anyone on this mailing list using GH authentication in Airflow? I received
an email from GH security about a concern about our integration (bellow).

I commented on the original commit and tagged the author and someone else
who touched the file here:
https://github.com/apache/incubator-airflow/commit/4796245be517aed06df21a85=
c93a2b86a7f31939

I'd love if someone using GH authentication could take the lead on this.

Thanks,

Max

---------- Forwarded message ----------
From: Patrick Toomey <@github.com>
Date: Wed, Aug 17, 2016 at 8:25 AM
Subject: Possible security bug in incubator-airflow OAuth GitHub Enterprise
auth
To: max


Hi,
  I am a member of the GitHub application security team and  happened to
recently run across https://github.com/apache/incubator-airflow, as someone
was looking at using it internally. While they were pulling together a
proof of concept, I noticed that they had included the
=E2=80=9Cgithub_enterprise_auth.py=E2=80=9D file. While browsing through th=
is file I
noticed something that stuck out. In particular, this line looks like it
could be a security issue: https://github.com/apache/incubator-airflow/blob=
/
821bdb5310c6c21cd9c0b9d0797873ff6114179d/airflow/contrib/
auth/backends/github_enterprise_auth.py#L159.  That lines appears to look
for a response from the =E2=80=9Cuser teams=E2=80=9D API for a team slug th=
at matches one
from the =E2=80=9Callowed_teams=E2=80=9D configuration option. However, thi=
s slug is just a
string, and doesn=E2=80=99t convey any information about a specific team. F=
or
example, an enterprise instance might create an organization =E2=80=9CAcme=
=E2=80=9D and
also create a team in this organization called =E2=80=9Cdesigners=E2=80=9D.=
 But, there
could also be another organization on that same Enterprise instance,
=E2=80=9CEvil=E2=80=9D, that also creates a team called =E2=80=9Cdesigners=
=E2=80=9D. I haven=E2=80=99t spun up a
working instance of this integration, so my apologies if I missed some
other bit of logic that would prevent this kind of attack. But, in general,
when you do this kind of validation, it is better to use an identifier that
is guaranteed to be globally unique across the GitHub instance. In the case
of a GitHub Enterprise instance, that would likely be the ID of the team,
which is also returned by the same API: https://developer.github.
com/v3/orgs/teams/#list-user-teams.

Thanks,
Patrick

--001a114a6d7604c98f053a665290--