File and resource vulnerability in Journalist interface partially mitigated
THREAT18
· Partially mitigated: Some controls are in place, but the risk is still too high.
· Defined in catalog.py:326
- Risk
- Medium impact × Low likelihood = 4 medium
- After mitigations
- Medium impact × Low likelihood = 4 medium (unchanged)
Failure to validate file contents may lead to execution of malicious code on the server.
Threat actors: Any
Mitigations
| Mitigation | Status |
|---|---|
| No external URL redirection MITIG212 | implemented |
| Untrusted uploaded data is directly encrypted and not executed MITIG213 | implemented |
| Journalist guide has cursory explanation of malware risks MITIG153 | implemented |
Possible further mitigations
- Journalist guide has detailed information about removing metadata and handling the malware threat MITIG88 proposed
- Use VMs to sandbox documents as they are opened. MITIG158 proposed
Where it applies
Applies to 1 component in 2 scenarios.
Journalist triage · Journalist Interface
Workstation: reading submissions · Journalist Interface
Notes
Existing mitigations: No external URL redirection (MITIG212). Untrusted uploaded data is directly encrypted and not executed (MITIG213). Journalist guide informs users of malware risks (https://docs.securedrop.org/en/stable/journalist.html) (MITIG153). Further mitigations: Further information should be provided to reduce the likelihood of malware contamination (isolation/sandboxing) (MITIG88, MITIG158). Automated test for mitigation: Yes.
How this threat is matched
Listed for these components. A boundary covers every component inside it.