Securedrop
Monthly
SecureDrop Server 2.5.0 through 2.15.x allows an attacker who already holds the secret Journalist Interface onion address, journalist authentication, and a live API session token to replay that API token against the web UI until its natural expiry of at most eight hours. The root cause is a mutable session-key prefix in the Flask SessionInterface that persists across requests, corrupting the Redis namespace separation introduced in 2.5.0; the same corruption can stop logout from deleting the correct Redis session, though normal expiry still applies. Impact is bounded to encrypted submissions and journalist-side actions on source submissions - no plaintext disclosure and no availability effect - and no public exploit has been identified at time of analysis.
A vulnerability was found in Freedom of the Press SecureDrop. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
SecureDrop Server 2.5.0 through 2.15.x allows an attacker who already holds the secret Journalist Interface onion address, journalist authentication, and a live API session token to replay that API token against the web UI until its natural expiry of at most eight hours. The root cause is a mutable session-key prefix in the Flask SessionInterface that persists across requests, corrupting the Redis namespace separation introduced in 2.5.0; the same corruption can stop logout from deleting the correct Redis session, though normal expiry still applies. Impact is bounded to encrypted submissions and journalist-side actions on source submissions - no plaintext disclosure and no availability effect - and no public exploit has been identified at time of analysis.
A vulnerability was found in Freedom of the Press SecureDrop. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.