PST-081: Any administrator can download a full backup holding every account's rows and files #810

New issue

Closed

opened 2026-10-10 10:56:49 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-10 10:56:49 +00:00

Owner

Found in the security audit of 2026-10-10 (SECURITY-AUDIT-2026-10-10.md), run against main at c30851b from 8 to 10 October 2026, as PST-081. Severity: Informational.

The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it.

Severity: Informational
Category: privilege-boundary (documented trade-off)
Location: src/postulo/core/views_backups.py (177-195)
Found by: business logic and imports

Who can do it, and what they need. Any account with is_staff (every administrator can be appointed by any other, #368). Precondition: staff on the instance.

How it works.

Open Server settings → Backups (StaffRequiredMixin via ServerSectionMixin).
Press Take a backup (BackupRunView), which writes a verified tar.gz of the database dump plus media/ and plugins/.
Download it (BackupDownloadView).
The archive contains every person's CVs, cover letters, contacts' home addresses, uploaded files and the password hashes; connection secrets are encrypted under POSTULO_FIELD_KEY, everything else is plain.

Impact. The threat model's row for 'Another account on the same instance' says Server settings shows administrators accounts and never anyone's applications or documents (#368); the backup page is the one place where that is not true. …

Verification (verdict: confirmed; severity after verification: Informational). Not a vulnerability: the attacker is the administrator the threat model explicitly trusts with the database, and the download adds a recent-authentication check, a WARNING log line naming who, 404 for non-staff, and security tests (tests/security/test_backups_page.py). Precondition stated precisely: is_staff (superuser not needed) plus a recent sign-in through the form (client.force_login alone is redirected to reauthenticate, as the existing test shows). …

Suggested remediation. Either state plainly in THREAT-MODEL.md (#368 row) that the Backups page is the exception, or gate backup download behind a second factor / operator-only setting (for example an environment flag that limits backup download to the console), and consider encrypting the archive with an operator-supplied key as the Hardening page already recommends.

Found in the security audit of 2026-10-10 (`SECURITY-AUDIT-2026-10-10.md`), run against `main` at `c30851b` from 8 to 10 October 2026, as **PST-081**. Severity: **Informational**. The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it. --- - **Severity:** Informational - **Category:** privilege-boundary (documented trade-off) - **Location:** `src/postulo/core/views_backups.py` (177-195) - **Found by:** business logic and imports **Who can do it, and what they need.** Any account with `is_staff` (every administrator can be appointed by any other, #368). Precondition: staff on the instance. **How it works.** 1. Open Server settings → Backups (StaffRequiredMixin via ServerSectionMixin). 2. Press *Take a backup* (`BackupRunView`), which writes a verified tar.gz of the database dump plus media/ and plugins/. 3. Download it (`BackupDownloadView`). 4. The archive contains every person's CVs, cover letters, contacts' home addresses, uploaded files and the password hashes; connection secrets are encrypted under POSTULO_FIELD_KEY, everything else is plain. **Impact.** The threat model's row for 'Another account on the same instance' says Server settings shows administrators accounts and never anyone's applications or documents (#368); the backup page is the one place where that is not true. … **Verification** (verdict: confirmed; severity after verification: Informational). Not a vulnerability: the attacker is the administrator the threat model explicitly trusts with the database, and the download adds a recent-authentication check, a WARNING log line naming who, 404 for non-staff, and security tests (tests/security/test_backups_page.py). Precondition stated precisely: is_staff (superuser not needed) plus a recent sign-in through the form (client.force_login alone is redirected to reauthenticate, as the existing test shows). … **Suggested remediation.** Either state plainly in THREAT-MODEL.md (#368 row) that the Backups page is the exception, or gate backup download behind a second factor / operator-only setting (for example an environment flag that limits backup download to the console), and consider encrypting the archive with an operator-supplied key as the Hardening page already recommends.

tiagoagueda added the

enhancement

security

labels

2026-10-10 10:56:50 +00:00

tiagoagueda added this to the 1.0.0 milestone

2026-10-10 10:58:13 +00:00

tiagoagueda referenced this issue

2026-10-10 10:58:40 +00:00

Security audit of 2026-10-10: index of PST-001 to PST-098 (#730–#827) #828

tiagoagueda referenced this issue

2026-10-10 14:13:33 +00:00