GHSA-r587-7jh2-4qr3: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was discovered in the Flood software (versions >= 2.0.0, < 3.0.0) where the server JWT signing secret was inadvertently included in static assets and served to clients. The vulnerability was discovered and disclosed on August 24, 2020, affecting the Flood torrent client web interface. This security issue was tracked as GHSA-r587-7jh2-4qr3 (GitHub Advisory).

The vulnerability originated when commit 8d11640b imported config.js to client frontend components to access the disableUsersAndAuth configuration variable. This resulted in the config.js contents, including the JWT signing secret, being compiled into static assets and served to users. The issue was particularly severe as it allowed attackers to bypass Flood's built-in authentication system by enabling them to sign their own authentication tokens (GitHub Advisory).

The vulnerability's impact was classified as Critical due to several factors. If exploited, it allowed bypassing Flood's built-in authentication system. This was particularly dangerous because Flood has access to rTorrent's SCGI interface (which is unprotected and allows arbitrary code execution) and typically has wide-ranging privileges to files. Combined with Flood's lack of security controls against authenticated users, this created a significant security risk (GitHub Advisory).

The vulnerability was exploitable by accessing the static assets served to clients, which contained the server's JWT signing secret. Attackers could use this secret to sign their own authentication tokens and bypass the built-in access control of Flood (GitHub Advisory).

The vulnerability was patched in version 3.0.0 through multiple commits. Commit 042cb4ce removed imports of config.js from client components and added an eslint rule to prevent future imports. Commit 103f53c8 implemented a general mitigation by adding checks to ensure the secret is not included in static assets before starting the server. For users unable to upgrade immediately, the recommended workaround was to use HTTP Basic Auth or other battle-hardened authentication methods instead of Flood's in-house authentication system. Users could also use the disableUsersAndAuth option to avoid duplicate authentication (GitHub Advisory).