Session management vulnerability in Source interface mitigated

THREAT19 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:343

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

An adversary that can compromise a user's session and perform action of the service on the user's behalf, such as uploading documents, sending messages and viewing journalist responses.

Threat actors: Any

Mitigations

Mitigation	Status
Use of Flask session management MITIG63	implemented
Session timeout on both interfaces MITIG17	implemented
All session data deleted upon logout except language so the logout messages can be localized MITIG172	implemented
Sources instructed to restart browser or clear the session to delete session cookie MITIG18	implemented

Possible further mitigations

Ensure multiple concurrent sessions not possible MITIG73 proposed
Secure cookie flag if TLS enabled on source interface MITIG66 proposed
Server-side session management: session IDs invalidated upon logout MITIG173 proposed

Where it applies

Applies to 1 component in 2 scenarios.

Source Interface Application Server

Source submission · Source Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Submit over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Source\nInterface";    ]
    component_Source_Interface_Application_Server -> component_SecureDrop_Application_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hand to app";    ]
    component_SecureDrop_Application_Application_Server -> component_Encrypted_submission_store_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Encrypt & store";    ]
    component_SecureDrop_Application_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Record metadata";    ]
}

Supply chain and dependencies · Source Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Notes

Existing mitigations: Flask is used for client-side session management (MITIG63). Sessions are invalidated when a user logs out and time out after 120 minutes (MITIG17) Session data (minus language) is discarded at logout (MITIG172), all session data is deleted upon exit of Tor Browser (MITIG18). Further mitigations: Verify that the application does not allow multiple active concurrent sessions (MITIG73). Enable "Secure" flag for cookies if TLS is enabled on source interface (MITIG66). Server-side session management (e.g. like in Django) (MITIG173). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.