mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-19 05:13:46 +09:00
Mike Dalessio
d28ab55bf4
Nothing in the repository records that unrestricted bot webhook delivery is deliberate, so the missing private-network guard reads as an oversight next to the guarded unfurl path. Researchers report it as server-side request forgery, repeatedly.
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# Security
|
|
|
|
Report vulnerabilities through our [HackerOne program](https://hackerone.com/basecamp) or at
|
|
https://github.com/basecamp/once-campfire/security. Note that Campfire is in scope for our security
|
|
program, but is not bounty eligible.
|
|
|
|
## Trust model
|
|
|
|
Campfire is self-hosted and single-tenant, so the administrator is the server operator,
|
|
with shell, network, and database access already. Anything requiring the administrator
|
|
role grants nothing they do not already have, and is not a vulnerability.
|
|
|
|
We do want reports of anything a **non-administrator** can reach, and of any credential or
|
|
network path held by the Campfire process but not by the operator's own shell.
|
|
|
|
## Intentional behavior
|
|
|
|
Bot webhook URLs are unrestricted: an administrator can point one at any address,
|
|
including internal ones, because operators legitimately wire bots to their own services.
|
|
Link unfurling is different because any member can trigger it by pasting a URL, so it
|
|
validates destinations through `RestrictedHTTP::PrivateNetworkGuard`. The difference is who
|
|
picks the destination.
|