Repository: freedomofpress/securedrop

Issue:
Overly permissive Database privileges for “securedrop” user
The privileges given the MySQL user accessing the SecureDrop database
are overly permissive and allow an attacker after a successful SQL
injection attack to escalate privileges:

Example: https://github.com/freedomofpress/securedrop/search?q=
GRANT+ALL+PRIVILEGES&ref=cmdform

```
echo "Setting up MySQL database..."
mysql -u root -p"$mysql_root" -e "create database securedrop; GRANT ALL
PRIVILEGES ON securedrop.* TO 'securedrop'@'localhost' IDENTIFIED BY
'$mysql_securedrop';"
```

It should be made sure that the user is only applied with privileges
that are actually needed. In case an attacker manages to spot a SQL
injection vulnerability, the user with an unlimited set of permissions
would be capable of compromising the machine via FILE and other SQL
features (depending on the MySQL version). From what can be seen from
the application’s logic, the database user essentially needs read-write
access to one particular database - and not “GRANT ALL PRIVILEGES”.

Reported as part of the cure53 audit of 0.2 as: SD-01-003



Discussion:
@dolanjs Make sure to set everything from the audit to milestone 0.2.1

cc @Hainish 


Resolving patch:
diff --git a/install_files/document.config.py b/install_files/document.config.py
--- a/install_files/document.config.py
+++ b/install_files/document.config.py
@@ -46,15 +46,15 @@ class TestingConfig(BaseConfig):
 # Database Configuration
 
 # Default to using a sqlite database file for development
-#DATABASE_ENGINE = 'sqlite'
-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
+DATABASE_ENGINE = 'sqlite'
+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
 
 # Uncomment to use mysql (or any other databaes backend supported by
 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
 # `python -c "import db; db.create_tables()"` to initialize the database
 
-DATABASE_ENGINE = 'mysql'
-DATABASE_HOST = 'localhost'
-DATABASE_NAME = 'securedrop'
-DATABASE_USERNAME = 'document_mysql'
-DATABASE_PASSWORD = 'MYSQL_USER_PASS'
+#DATABASE_ENGINE = 'mysql'
+#DATABASE_HOST = 'localhost'
+#DATABASE_NAME = 'securedrop'
+#DATABASE_USERNAME = 'document_mysql'
+#DATABASE_PASSWORD = 'MYSQL_USER_PASS'
diff --git a/install_files/source.config.py b/install_files/source.config.py
--- a/install_files/source.config.py
+++ b/install_files/source.config.py
@@ -45,15 +45,16 @@ class TestingConfig(BaseConfig):
 # Database Configuration
 
 # Default to using a sqlite database file for development
-#DATABASE_ENGINE = 'sqlite'
-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
+DATABASE_ENGINE = 'sqlite'
+SECUREDROP_ROOT=os.path.abspath('/var/www/securedrop')
+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
 
 # Uncomment to use mysql (or any other databaes backend supported by
 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
 # `python -c "import db; db.create_tables()"` to initialize the database
 
-DATABASE_ENGINE = 'mysql'
-DATABASE_HOST = 'localhost'
-DATABASE_NAME = 'securedrop'
-DATABASE_USERNAME = 'securedrop'
-DATABASE_PASSWORD = ''
+#DATABASE_ENGINE = 'mysql'
+#DATABASE_HOST = 'localhost'
+#DATABASE_NAME = 'securedrop'
+#DATABASE_USERNAME = 'securedrop'
+#DATABASE_PASSWORD = ''


Test patch: