I haven’t seen this posted yet here, but anybody self-hosting OwnCloud in a containerized environment may be exposing sensitive environment variables to the public internet. There may be other implications as well.
Nextcloud is the right answer
Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud
Submitted 1 year ago by Anonymouse@lemmy.world to selfhosted@lemmy.world
Comments
possiblylinux127@lemmy.zip 1 year ago
deepdive@lemmy.world 1 year ago
That’s way exposing your home services to the internet is a bad idea. Accessing it through a secure tunnel is the way to go.
Also, they already “fixed” the docker image with an update, something todo with phpinfo…
i_am_not_a_robot@discuss.tchncs.de 1 year ago
Nobody cares about your home services unless they can use them to send spam or mine bitcoin. Owncloud is a funny name because it seems to imply it’s for personal use: your own cloud. I didn’t know until I found myself in one, but apparently a lot of schools use Owncloud.
phpinfo is just a bad idea. It’s a built in facility that dumps everything without knowing whether it’s sensitive or not, right into the current page, making it trivial to add this vulnerability to your own application or library that an unsuspecting developer will include into their application. There’s not even a single security warning in the documentation. Here’s practically the same problem from 21 years ago: nvd.nist.gov/vuln/detail/CVE-2002-1725
TCB13@lemmy.world 1 year ago
“Docker is safer” sure.
sudneo@lemmy.world 1 year ago
The only thing that makes this case worse in docker is that more info is in ENV variables. The vulnerability has nothing to do with containers though, and using ENV variables to provide sensitive data is in general a bad decision, since they can be leaked to any process with /proc access.
Unfortunately, ENV is still a common way which people use to pass data to applications inside containers, but it is not in any way a requirement imposed by the tech.
Anonymouse@lemmy.world 1 year ago
I’m using Kubernetes and many of the apps that I use require environment variables to pass secrets. Another option is the pod definition, which is viewable by anybody with read privileges to K8s. Secrets are great to secure it on the K8s side, but the application either needs to read the secret from a file or you build your own helm chart with a shell front end to create app config files on the fly. I’m sure there are other options, but there’s no “one size fits all” type solution.
The real issue here is that the app is happy to expose it’s environment variables with no consideration given to the fact that it may contain data that can be misused by bad actors. It’s security 101 to not expose any more than the user needs to see which is why stack dumps are disabled on production implementations.
inspxtr@lemmy.world 1 year ago
what are the other alternatives to ENV that are more preferred in terms of security?
TCB13@lemmy.world 1 year ago
No, but it only happens because this tech exists in the first place and things got way more cumbersome and way overcomplicated than they should be.
possiblylinux127@lemmy.zip 1 year ago
If you do it right, possibly.
Decronym@lemmy.decronym.xyz 1 year ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters NAT Network Address Translation VPS Virtual Private Server (opposed to shared hosting) k8s Kubernetes container management package
[Thread #330 for this sub, first seen 3rd Dec 2023, 04:05] [FAQ] [Full list] [Contact] [Source code]
tagginator@utter.online [bot] 1 year ago
New Lemmy Post: Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud (https://lemmy.world/post/9020812)
Tagging: #SelfHosted(Replying in the OP of this thread (NOT THIS BOT!) will appear as a comment in the lemmy discussion.)
I am a FOSS bot. Check my README: https://github.com/db0/lemmy-tagginator/blob/main/README.md
astraeus@programming.dev 1 year ago
OwnCloud? More like PwnCloud