Attacker obtains code execution in sd-viewer VM partially mitigated

THREATQW1 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2977

Risk: High impact × Medium likelihood = 9 high
After mitigations: Low impact × Low likelihood = 2 low

How statuses and scores work

An attacker submits malware to a SecureDrop instance exploiting an unpatched vulnerability in the software running on the sd-viewer VM

Mitigations

Mitigation	Status
Use non-networked disposible VMs for opening all decrypted files. MITIGQW18	implemented
sd-proxy has server hardcoded MITIGQW36	proposed

Possible further mitigations

grsecurity in all Debian templates MITIGQW3 implemented
Limiting size of journalist replies. MITIGQW37 proposed
Logging exfiltration attempts. MITIGQW38 proposed
Throttling. MITIGQW39 proposed

Residual risk

Full attack surface of a Linux host. Attacker can exfiltrate documents via replies to sources.

Related threats

This threat is part of: Vulnerability introduced in provisioning code THREATQW15

Smaller threats that make up this one:

Privilege escalation (Xen vulnerability) THREATQW11 accepted
Vulnerability in the QubesOS management layer THREATQW27 transferred

Where it applies

Applies to 1 component in 2 scenarios.

sd-viewer (disposable VMs) Workstation VMs

Workstation: reading submissions · sd-viewer (disposable VMs)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_proxy_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-proxy";
                URL = "component_sd_proxy.html";
                tooltip = "sd-proxy";
                margin = 0.02;
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sys_firewall_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-firewall";
                URL = "component_sys_firewall.html";
                tooltip = "sys-firewall";
                margin = 0.02;
            ]

            component_sys_net_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-net";
                URL = "component_sys_net.html";
                tooltip = "sys-net";
                margin = 0.02;
            ]

        }

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Use the client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_proxy_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist API\nrequest";    ]
    component_sd_proxy_Workstation_VMs -> component_sys_firewall_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Route via\nfirewall";    ]
    component_sys_firewall_Workstation_VMs -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "4. Route to network";    ]
    component_sys_net_Workstation_VMs -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reach the\nJournalist Interface";    ]
    component_Journalist_Interface_Application_Server -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Encrypted\nsubmissions";    ]
    component_sd_proxy_Workstation_VMs -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "7. Relay to client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Decrypt";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "9. Open a file";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "10. Send logs";    ]
}

Workstation: export and print · sd-viewer (disposable VMs)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_devices__export_and_print__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-devices\n(export and\nprint)";
                URL = "component_sd_devices__export_and_print_.html";
                tooltip = "sd-devices (export and print)";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sys_usb_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-usb";
                URL = "component_sys_usb.html";
                tooltip = "sys-usb";
                margin = 0.02;
            ]

        }

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Choose export";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Hand file to\nexport VM";    ]
    component_sys_usb_Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Attach USB device";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Write to drive";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "5. Preview in\ndisposable VM";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Send logs";    ]
}

Notes

Existing mitigations: Display VM is a disposable VM and is recreated for each submission (MITIGQW18), Qubes uses Xen-based PVH virtualization for VMs. Display VM does not have network access. Exfiltration of documents can only occur via sd-proxy (MITIGQW36). Further mitigations: Use a hardened template VM for the DisplayVM: grsecurity (MITIGQW3) and apparmor would help protect against unknown vulnerabilities or if the template was improperly patched. Limiting size of journalist replies (MITIGQW37). Logging exfiltration attempts (MITIGQW38). Throttling (MITIGQW39).

How this threat is matched

Listed for these components. A boundary covers every component inside it.