| Known vulnerability in any VM template THREATQW22 |
sd-app (SecureDrop Client) |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sd-gpg |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sd-log |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sd-proxy |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sd-viewer (disposable VMs) |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sys-firewall |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Known vulnerability in any VM template THREATQW22 |
sys-net |
mitigated |
12 high |
6 medium |
Autoupdate all VMs; grsecurity in all Debian templates |
| Segmentation between Journalist and Source interfaces THREAT6 |
Journalist Interface |
partially mitigated |
9 high |
6 medium |
Apache configured to expose source interface only via app-source-ths and journalist interface via app-journo-aths |
| Attacker obtains code execution in proxy VM THREATQW23 |
sd-proxy |
mitigated |
9 high |
6 medium |
qrexec that proxies API requests and responses only to SecureDrop application server |
| Session management vulnerability in Journalist interface THREAT7 |
Journalist Interface |
mitigated |
6 medium |
6 medium |
Use of Flask session management; Session timeout on both interfaces; Journalist interface: Set-Cookie ^(.*)$ $;HttpOnly; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie; HidServAuth token on journalist interface |
| Malicious input vulnerability in Journalist interface THREAT8 |
Journalist Interface |
mitigated |
6 medium |
6 medium |
X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping; HidServAuth token on journalist interface |
| Malicious VM template THREATQW28 |
sd-app (SecureDrop Client) |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sd-gpg |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sd-log |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sd-proxy |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sd-viewer (disposable VMs) |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sys-firewall |
mitigated |
6 medium |
6 medium |
|
| Malicious VM template THREATQW28 |
sys-net |
mitigated |
6 medium |
6 medium |
|
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sd-app (SecureDrop Client) |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sd-gpg |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sd-log |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sd-proxy |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sd-viewer (disposable VMs) |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sys-firewall |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 |
sys-net |
partially mitigated |
6 medium |
6 medium |
Use non-networked disposible VMs for opening all decrypted files. |
| Admin error in provisioning of the workstation THREATQW31 |
sd-app (SecureDrop Client) |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sd-gpg |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sd-log |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sd-proxy |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sd-viewer (disposable VMs) |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sys-firewall |
inform |
6 medium |
6 medium |
|
| Admin error in provisioning of the workstation THREATQW31 |
sys-net |
inform |
6 medium |
6 medium |
|
| Plaintext submissions exfiltrated THREATQW40 |
sd-app (SecureDrop Client) |
partially mitigated |
6 medium |
6 medium |
sd-proxy has server hardcoded; sd-client running in non networked VM |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sd-app (SecureDrop Client) |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sd-gpg |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sd-log |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sd-proxy |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sd-viewer (disposable VMs) |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sys-firewall |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 |
sys-net |
partially mitigated |
6 medium |
6 medium |
grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs |
| Authentication vulnerability in Journalist interface THREAT13 |
Journalist Interface |
mitigated |
6 medium |
4 medium |
Passphrases are stored salted and hashed; 2FA token required for login to admin or journalist interfaces; ATHS token for Journalist Interface and API; Passphrases for journalists and admins are generated to be 7 word diceware; Journalist logins are throttled; Routes login protected by default on journalist interface |
| Attacker obtains code execution in any VM THREATQW36 |
sd-app (SecureDrop Client) |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sd-gpg |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sd-log |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sd-proxy |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sd-viewer (disposable VMs) |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sys-firewall |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Attacker obtains code execution in any VM THREATQW36 |
sys-net |
partially mitigated |
6 medium |
4 medium |
Default Qubes-RPC deny policy; grsecurity in all Debian templates |
| Access control vulnerability in Journalist interface THREAT14 |
Journalist Interface |
mitigated |
4 medium |
4 medium |
Journalist interface is one big inbox (makes for simple logic); Only 2 roles in journalist / admin interface; CSRF from Flask used |
| Data protection vulnerability in Journalist interface THREAT15 |
Journalist Interface |
mitigated |
4 medium |
4 medium |
Source interface: Cache-Control nostore; Sensitive data sent in POST requests |
| Communications vulnerability in Journalist interface THREAT17 |
Journalist Interface |
mitigated |
4 medium |
4 medium |
Journalist interface only available as a Tor onion service |
| File and resource vulnerability in Journalist interface THREAT18 |
Journalist Interface |
partially mitigated |
4 medium |
4 medium |
No external URL redirection; Untrusted uploaded data is directly encrypted and not executed; Journalist guide has cursory explanation of malware risks |
| Error handling and logging vulnerability in Journalist interface THREAT26 |
Journalist Interface |
mitigated |
4 medium |
4 medium |
Debugging is disabled; Journalist interface: Sensitive information is not logged |
| Business Logic vulnerability in Journalist interface THREAT146 |
Journalist Interface |
partially mitigated |
4 medium |
4 medium |
Journalist interface business logic is simple |
| Journalist user performs malicious action under another user's account THREAT170 |
Journalist Interface |
out of scope |
4 medium |
4 medium |
2FA token required for login to admin or journalist interfaces; Persistent storage FDE for Journalist Workstation |
| Information disclosure (Xen vulnerability) THREATQW21 |
sd-app (SecureDrop Client) |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sd-gpg |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sd-log |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sd-proxy |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sd-viewer (disposable VMs) |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sys-firewall |
accepted |
4 medium |
4 medium |
|
| Information disclosure (Xen vulnerability) THREATQW21 |
sys-net |
accepted |
4 medium |
4 medium |
|
| Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 |
sd-app (SecureDrop Client) |
partially mitigated |
4 medium |
4 medium |
sd-client running in non networked VM |
| Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 |
sd-proxy |
partially mitigated |
4 medium |
4 medium |
sd-client running in non networked VM |
| Attacker tampers with replies in sd-proxy THREATQW42 |
sd-proxy |
accepted |
4 medium |
4 medium |
|
| DMA executed from compromised network VM (in a system that lacks VT-d) THREATQW47 |
sys-net |
mitigated |
3 low |
4 medium |
|
| User error while operating the workstation THREATQW19 |
sd-app (SecureDrop Client) |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sd-gpg |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sd-log |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sd-proxy |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sd-viewer (disposable VMs) |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sys-firewall |
partially mitigated |
9 high |
3 low |
|
| User error while operating the workstation THREATQW19 |
sys-net |
partially mitigated |
9 high |
3 low |
|
| Journalist interface is framed THREAT33 |
Journalist Interface |
mitigated |
6 medium |
3 low |
X-FRAME-OPTIONS DENY HTTP header; HidServAuth token on journalist interface |
| Unknown vulnerability in a VM template THREATQW10 |
sd-app (SecureDrop Client) |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sd-gpg |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sd-log |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sd-proxy |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sd-viewer (disposable VMs) |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sys-firewall |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Unknown vulnerability in a VM template THREATQW10 |
sys-net |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sd-app (SecureDrop Client) |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sd-gpg |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sd-log |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sd-proxy |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sd-viewer (disposable VMs) |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sys-firewall |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Privilege escalation (Xen vulnerability) THREATQW11 |
sys-net |
accepted |
6 medium |
3 low |
grsecurity in all Debian templates |
| Attacker obtains code execution in the sd-app VM THREATQW18 |
sd-app (SecureDrop Client) |
mitigated |
6 medium |
3 low |
grsecurity in all Debian templates |
| Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 |
sd-viewer (disposable VMs) |
partially mitigated |
3 low |
3 low |
Use non-networked disposible VMs for opening all decrypted files. |
| Zip bomb THREATQW53 |
sd-app (SecureDrop Client) |
partially mitigated |
3 low |
3 low |
|
| Attacker obtains code execution in the Network VM THREATQW17 |
sys-net |
partially mitigated |
2 low |
3 low |
|
| Attacker obtains code execution in sd-viewer VM THREATQW1 |
sd-viewer (disposable VMs) |
partially mitigated |
9 high |
2 low |
Use non-networked disposible VMs for opening all decrypted files.; sd-proxy has server hardcoded |
| MIME hander in sd-app doesn't handle submission format THREATQW8 |
sd-viewer (disposable VMs) |
mitigated |
9 high |
2 low |
|
| Injection vulnerability in securedrop-client THREATQW9 |
sd-app (SecureDrop Client) |
mitigated |
9 high |
2 low |
Use non-networked disposible VMs for opening all decrypted files. |
| Macro executed in malicious office file THREATQW46 |
sd-viewer (disposable VMs) |
mitigated |
9 high |
2 low |
Use non-networked disposible VMs for opening all decrypted files. |
| Attacker obtains code execution in the GPG VM THREATQW6 |
sd-gpg |
partially mitigated |
6 medium |
2 low |
|
| GPG VM (sd-gpg) performs attacker file decryption THREATQW7 |
sd-gpg |
mitigated |
6 medium |
2 low |
|
| Web services vulnerability in Journalist interface THREAT82 |
Journalist Interface |
mitigated |
4 medium |
2 low |
Journalist interface business logic is simple; ATHS token for Journalist Interface and API |
| Attacker obtains code execution on sd-gpg VM THREATQW5 |
sd-gpg |
partially mitigated |
4 medium |
2 low |
|
| Journalist interface hidden service secret exfiltrated THREATQW39 |
sd-proxy |
partially mitigated |
4 medium |
2 low |
|
| Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use THREATQW67 |
sd-proxy |
partially mitigated |
4 medium |
2 low |
|
| Adversary exploits gzip parsing to get code execution THREATQW37 |
sd-app (SecureDrop Client) |
accepted |
3 low |
2 low |
sd-client running in non networked VM; grsecurity in all Debian templates |
| Large file DoS in client THREATQW57 |
sd-app (SecureDrop Client) |
partially mitigated |
3 low |
2 low |
Forms use WTForms validators |
| Journalist user marks all submissions as seen THREAT171 |
Journalist Interface |
out of scope |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sd-app (SecureDrop Client) |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sd-gpg |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sd-log |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sd-proxy |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sd-viewer (disposable VMs) |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sys-firewall |
accepted |
2 low |
2 low |
|
| DoS (Xen vulnerability) THREATQW3 |
sys-net |
accepted |
2 low |
2 low |
|
| Attacker obtains code execution in the Firewall VM THREATQW4 |
sys-firewall |
partially mitigated |
2 low |
2 low |
|
| Failure in mime handling in sd-viewer THREATQW45 |
sd-viewer (disposable VMs) |
partially mitigated |
2 low |
2 low |
Execute bit is dropped during server side archive/clientside unarchive process |
| Compromised VM spoofs log origin THREATQW56 |
sd-app (SecureDrop Client) |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sd-gpg |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sd-log |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sd-proxy |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sd-viewer (disposable VMs) |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sys-firewall |
accepted |
2 low |
2 low |
|
| Compromised VM spoofs log origin THREATQW56 |
sys-net |
accepted |
2 low |
2 low |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sd-app (SecureDrop Client) |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sd-gpg |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sd-log |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sd-proxy |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sd-viewer (disposable VMs) |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sys-firewall |
accepted |
Unknown |
Unknown |
|
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 |
sys-net |
accepted |
Unknown |
Unknown |
|
| Code injection via messages into App render process THREATQW62 |
sd-app (SecureDrop Client) |
unmanaged |
Unknown |
Unknown |
|
| Malicious message plaintext is stored in database THREATQW63 |
sd-app (SecureDrop Client) |
unmanaged |
Unknown |
Unknown |
|
| Code injection via malicious attachments in App THREATQW64 |
sd-app (SecureDrop Client) |
unmanaged |
Unknown |
Unknown |
|
| Malware via malicious attachments in App THREATQW65 |
sd-app (SecureDrop Client) |
unmanaged |
Unknown |
Unknown |
|
| Data loss because of risk mitigations like sanatization THREATQW66 |
sd-app (SecureDrop Client) |
unmanaged |
Unknown |
Unknown |
|